EUVD-2026-109983

zip: AES Entry HMAC Authentication Bypass on Premature EOF...

GHSA-8HXF-QR8P-62X4 zip: AES Entry HMAC Authentication Bypass on Premature EOF

Summary An AES-encrypted AE-x entry's authentication code is verified only when the reader's byte counter lands exactly on zero. If the bounded entry reader reaches the archive's actual EOF before the attacker-controlled, header-declared compressedsize, the counter remains positive, the HMAC is...

zip: AES Entry HMAC Authentication Bypass on Premature EOF

Summary An AES-encrypted AE-x entry's authentication code is verified only when the reader's byte counter lands exactly on zero. If the bounded entry reader reaches the archive's actual EOF before the attacker-controlled, header-declared compressedsize, the counter remains positive, the HMAC is...

SUSE CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

UBUNTU-CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

Linux Distros Unpatched Vulnerability : CVE-2026-115906

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC...

CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

CVE-2026-115906

The zip library for Rust (versions 0.6.0 through 9.0.0 ) contains a vulnerability in the AES entry reader (src/aes.rs). The component fails to verify the HMAC authentication tag if the archive reaches the end of the stream while the data counter is still positive, or if an encrypted entry lacks a...

CVE-2026-115906 zip: AES Entry HMAC Authentication Bypass on Premature EOF

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

CVE-2026-115906 zip: AES Entry HMAC Authentication Bypass on Premature EOF

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

CVE-2026-115906 zip: AES Entry HMAC Authentication Bypass on Premature EOF

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

PT-2026-123429

Name of the Vulnerable Software and Affected Versions zip versions 0.6.0 through 8.9.9 Description The AES entry reader in src/aes.rs verifies its HMAC Hash-based Message Authentication Code, a mechanism for verifying both the data integrity and the authenticity of a message only when the...

zip-rs zip input validation error vulnerability

A security vulnerability exists in zip-rs versions from zip 0.6.0 up to but not including version 9.0.0. This vulnerability arises because the AES entry reader in src/aes.rs validates HMAC only when the data counter controlled by the attacker is set to zero. However, when the underlying bounded...