CVE-2026-115909: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-115909 is an unbounded memory allocation vulnerability in the zip2 Rust crate (zip-rs) that allows an unauthenticated remote attacker to cause an unrecoverable process abort via a crafted ZIP archive. Affected versions span from 1.3.0 up to (but not including) 9.0.0. The vulnerability was published on October 26, 2026, with the fix merged on September 14, 2026, and released in version 9.0.0. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-789 (Memory Allocation with Excessive Size Value). In src/read/mod.rs, the ZipArchive::extract_internal() function's symbolic-link branch calls Vec::with_capacity(file.size() as usize) where file.size() returns the uncompressed_size verbatim from the ZIP central directory record — a fully attacker-controlled value. A ZIP64 extended-information extra field can widen this to a full u64, and the value is never validated against the compressed size, remaining archive length, or any platform-appropriate symlink path length limit. Because Vec::with_capacity() uses an infallible allocator path, a refused allocation calls handle_alloc_error(), which issues SIGABRT — this is not a Rust panic and cannot be caught by catch_unwind, panic = "unwind", or isolation in a worker thread. A 112-byte crafted archive declaring uncompressed_size = 2^62 is sufficient to deterministically abort the process on x86-64 Linux regardless of installed RAM (GitHub Advisory, Fix PR).

Exploitation results in an unrecoverable, uncatchable termination (exit 134 / SIGABRT) of any process calling ZipArchive::extract() on attacker-supplied input, enabling repeated denial of service. Applications such as upload handlers, mail-attachment processors, package/artifact ingestion pipelines, backup restore services, and container-image layer extractors are all in scope. There is no confidentiality or integrity impact — no memory unsafety, out-of-bounds access, data disclosure, or data corruption occurs (GitHub Advisory).

A public proof-of-concept (PoC) is included in the GitHub Security Advisory, consisting of a 112-byte ZIP archive and a minimal Rust harness that reproducibly aborts the target process. No authentication, user interaction, or special privileges are required, and the NVD SSVC assessment marks the vulnerability as automatable. The EPSS score is 0.0 as of publication, and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory, Feedly).

1. Craft the malicious archive: Construct a ZIP64 archive (as small as 112 bytes) containing a single entry whose external attributes set the S_IFLNK bit (e.g., 0xA1FF0000), making the library treat it as a symbolic link. Set the ZIP64 uncompressed_size field to a large value such as 2^62 (4611686018427387904) while storing zero or minimal actual payload bytes.
2. Deliver the archive: Submit the crafted archive to any application that calls ZipArchive::extract() on user-supplied input — e.g., upload it via a web form, attach it to an email, or inject it into a package feed.
3. Trigger extraction: The target application opens the archive and calls ZipArchive::extract(). When processing the symlink entry, the library reads file.size() (returning the attacker-declared 2^62) and passes it directly to Vec::with_capacity().
4. Process abort: The allocator refuses the impossible reservation and calls handle_alloc_error(), issuing SIGABRT (exit 134). The process terminates immediately and unconditionally — catch_unwind, worker thread isolation, and panic = "unwind" all fail to contain it.
5. Repeat for sustained DoS: Because the abort is deterministic and requires no state, the attacker can resubmit the same 112-byte archive to continuously crash the service (GitHub Advisory, Fix PR).

• Process: The archive-processing process terminates with exit code 134 (SIGABRT); kernel or system logs show memory allocation of 4611686018427387904 bytes failed followed by Aborted (core dumped).
• Logs: Application logs show an abrupt, unhandled termination with no preceding Rust panic message or stack unwind; core dump files generated by the service user in the working directory or /var/crash.
• File System: Presence of a core dump file (e.g., core, core.<pid>) in the application's working directory coinciding with ZIP processing activity; temporary extraction directories (e.g., /tmp/zip-poc/) created but left incomplete.
• Network: Repeated submission of unusually small ZIP files (≤200 bytes) to upload or archive-processing endpoints, particularly from the same source IP, correlating with service restarts (GitHub Advisory).

Upgrade the zip2 crate to version 9.0.0, which rejects symlink entries whose declared uncompressed_size exceeds MAX_SYMLINK_TARGET_LEN (4096 bytes) with an InvalidArchive error instead of pre-allocating. The fix is applied to both src/read/mod.rs and src/read/stream.rs to prevent drift between extraction paths. No configuration-based workaround exists at the call site — catch_unwind and worker thread isolation do not mitigate the abort. As a temporary measure, applications can pre-screen archives for symlink entries with oversized declared sizes before passing them to extract() (Fix Commit, v9.0.0 Release).

The vulnerability was discovered and reported by security researchers kirk-baird and secstant-sigp, with the remediation patch developed by contributor li-jin-quan (with AI assistance) and reviewed and merged by maintainer Pr0methean. The fix discussion on GitHub PR #984 highlighted that simply capping the Vec::with_capacity call was insufficient — the correct fix is to reject oversized entries outright, since read_to_end would still read the declared size into memory even with a capped pre-allocation. The advisory notes that the crate already applied analogous bounds-checking to the central directory file count, making the omission in the symlink branch a consistency gap (Fix PR, GitHub Advisory).