CVE catalog
CVE-2026-115905
rust-zip: CVE-2026-115905
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rust-zip | sid | 9.0.5+ds-1 | vulnerable |
| Debian | rust-zip | forky | 5.1.1+dfsg-1 | vulnerable |
| Debian | rust-zip | trixie | 2.5.0-1 | vulnerable |
| Debian | rust-zip | bookworm | 0.6.3-3 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rust-zip | source | sid | (unfixed) | not yet assigned | Not reported | [1152227] |
| Debian | rust-zip | source | forky | (unfixed) | not yet assigned | Not reported | [1152227] |
| Debian | rust-zip | source | trixie | (unfixed) | not yet assigned | Not reported | [1152227] |
| Debian | rust-zip | source | bookworm | (unfixed) | not yet assigned | Not reported | [1152227] |
Notes
[trixie] rust-zip: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [librust-zip-dev]Affected
Source package: [rust-zip]
Details (2)
0.6.3-3· amd64 · bookwormAffected
dsa · rust-zip · debian · bookworm; dsa · rust-zip · debian · 12
0.6.3-3· arm64 · bookwormAffected
dsa · rust-zip · debian · bookworm; dsa · rust-zip · debian · 12
[Debian 13 (Trixie)]
- [librust-zip-dev]Affected
Source package: [rust-zip]
Details (2)
2.5.0-1· amd64 · trixieAffected
dsa · rust-zip · debian · 13
2.5.0-1· arm64 · trixieAffected
dsa · rust-zip · debian · 13
Observed: