CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

CVE-2026-115906

The zip library for Rust (versions 0.6.0 through 9.0.0 ) contains a vulnerability in the AES entry reader (src/aes.rs). The component fails to verify the HMAC authentication tag if the archive reaches the end of the stream while the data counter is still positive, or if an encrypted entry lacks a...