CVE-2026-115909 zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...