zip-rs zip2 vulnerabilities
6 published CVEs name zip-rs zip2 among the affected products.
- 6Published CVEs6 of them scored
- 5Last 12 monthspublished in the last year
- 1Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-115909
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
zip-rs · zip2
High7.5 - CVE-2026-115908
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)
zip-rs · zip2
High7.4 - CVE-2026-115907
zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
zip-rs · zip2
High7.5 - CVE-2026-115906
zip: AES Entry HMAC Authentication Bypass on Premature EOF
zip-rs · zip2
Medium6.5 - CVE-2026-115905
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
zip-rs · zip2
Critical10.0 - CVE-2025-29787
zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write
zip-rs · zip2
High7.3