Denial of Service Vulnerability in adm-zip by ctHackers

CVE-2026-39244

What is CVE-2026-39244?

The adm-zip library prior to version 0.5.18 is susceptible to a denial of service attack caused by a crafted ZIP file. An attacker can manipulate the ZIP file's uncompressed size header to allocate an excessive amount of memory, leading to potential process crashes. Specifically, the vulnerability arises when memory is allocated based on the declared uncompressed size without proper validation. This can result in significant memory consumption, leading to application failure when processing untrusted ZIP files. Affected methods include readFile(), readAsText(), and various extraction methods, making it critical for developers to implement safeguards and update their libraries to prevent exploitation.

References