What’s Vulnerable › Products

zip-rs zip2 vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your zip-rs zip2 version is affected

Latest zip-rs zip2 vulnerabilities

• CVE-2026-115905 — zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE (CVSS 10.0)
• CVE-2026-115909 — zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction (CVSS 7.5)
• CVE-2026-115908 — zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) (CVSS 7.4)
• CVE-2026-115907 — zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size (CVSS 7.5)
• CVE-2026-115906 — zip: AES Entry HMAC Authentication Bypass on Premature EOF (CVSS 6.5)
• CVE-2025-29787 — zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write (CVSS 7.3)