zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

Summary The symbolic-link branch of ZipArchive::extractinternal allocates a buffer using an attacker-declared size before reading any entry data. A 112-byte archive terminates the extracting process with SIGABRT through this infallible allocation. Details rust cfganyunix, windows if file.issymlin...

CVE-2026-115909 zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...

CVE-2026-48107

Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a malicious SSH server could send a USERAUTHINFOREQUEST with an attacker-controlled prompt count, and the client would use that raw count direct...

CVE-2026-48107: Improper Input Validation

Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a malicious SSH server could send a USERAUTHINFOREQUEST with an attacker-controlled prompt count, and the client would use that raw count direct...

PT-2025-45714

The safe function create ring buffer allocates a buffer using Vec::with capacity followed by set len, creating a Box containing uninitialized memory. This leads to undefined behavior when functions like write slices create typed slices e.g., &mut bool over the uninitialized memory, violating Rust...