GHSA-66HP-WGXQ-6F5Q rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...

CVE-2026-88014

rclone versions 1.72.0 through 1.75.1 are affected by a Zip Slip vulnerability in the archive ZIP backend ((*Fs).readZip in backend/archive/zip/zip.go). The method accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without verifying they remai...

CVE-2026-88014 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

PT-2026-89475

Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...

PT-2026-89686

Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...

Astra Linux – Vulnerability in Golang-1.15

In versions of Go prior to 1.15.13 and 1.16.x prior to 1.16.5, a crafted file count present in the archive’s header can lead to a panic in NewReader or OpenReader...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

Archive/Zip uses a super-linear file name indexing algorithm that is invoked the first time a file within an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive...

Oracle Linux 8 : perl:5.32 (ELSA-2026-48225)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-48225 advisory. - Fix CVE-2025-40909 - Clone dirhandles without fchdir perl-Algorithm-Diff - Fix CVE-2026-9538: Denial of Service via crafted tar header with large entry size...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the archivewritezipheader function when ZIP encryption is enabled and the entry file size is close to INT64MAX. An attacker can cause undefined behavior, such as incorrect Zip64 extension decisions or a...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

RHCOS 4 : OpenShift Container Platform 4.14.68 (RHSA-2026:28886)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28886 advisory. - golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 - golang: archive/zip: Excessive CPU...

Oracle Linux 8 : perl:5.32 (ELSA-2026-30851)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-30851 advisory. - Fix CVE-2025-40909 - Clone dirhandles without fchdir perl-Algorithm-Diff - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extra...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

RHCOS 4 : OpenShift Container Platform 4.13.68 (RHSA-2026:26541)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:26541 advisory. - golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 - golang: net/url: Memory exhaustion in quer...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

RockyLinux 9 : osbuild-composer (RLSA-2026:22714)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22714 advisory. golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 golang: net/url: Memory exhaustion in query...

RockyLinux 10 : osbuild-composer (RLSA-2026:22450)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22450 advisory. golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 golang: net/url: Memory exhaustion in query...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...