ZIP Library for Rust Vulnerability in AES Entry Reader

CVE-2026-115906

What is CVE-2026-115906?

The ZIP library for Rust has an improper authentication vulnerability in its AES entry reader. When using versions between 0.6.0 and 9.0.0, the HMAC verification occurs only when the attacker-controlled data counter reaches zero. Consequently, if the data reader encounters the real end of the archive while data remains or if an encrypted entry lacks a payload, the library may accept modified plaintext without raising an authentication error. This poses significant risks to data integrity for applications leveraging certain decryption methods, underscoring the importance of updating to version 9.0.0 where this issue has been resolved.

References