[munimv2]

Four zip advisories that the zip-rs/zip2 maintainers published as GitHub repository advisories on 2026-10-17 and 2026-10-22. GitHub reviewed all four on 2026-10-28/29 and they have CVEs, but none has a RustSec entry yet (checked on rustsec.org and in this repository's pull requests on 2026-11-14). The fifth advisory from that batch, GHSA-q7v9-x93c-xqv3, is already RUSTSEC-2026-0429.

Affected crate(s)

• zip:
  • GHSA-m665-v7pm-7grj (critical upstream, CVE-2026-115905): ZipStreamReader and read_zipfile_from_stream use local-header names, ZipArchive uses central-directory names, so one archive can show different files to each. Upstream: all versions before 9.0.5. Note: the 9.0.5 fix is an opt-in check. ZipStreamReader::new() sets enforce_header_consistency: false ("For backward-compatibility, this doesn't check that the local headers match the central directory"), ZipReadOptions derives Default, and extract() does not turn the check on; this is unchanged in 9.5.1 (src/read/stream.rs on docs.rs). The entry keeps patched = [">= 9.0.5"] as upstream does, and the description says the check has to be enabled.
  • GHSA-hjqx-j4rw-g7xv (high, CVE-2026-115908): symlink targets checked only as text, and absolute targets accepted from 7.2.0 (commit d5cf4b55 in the advisory), so chained symlinks write outside the destination. >= 7.2.0, < 9.0.0; the reporter reproduced it on 9.0.0-pre3. This is a different bug from RUSTSEC-2026-0368 (GHSA-4v9h-p7m9-rh26), which already covers earlier releases for symlink targets outside the destination; the lower bound follows upstream.
  • GHSA-9hj8-73fh-9963 (high, CVE-2026-115907): Shrink/Reduce/Implode decoders reserve the declared ZIP64 size. >= 5.1.0, < 9.0.0. The legacy-zip feature first appears in 5.1.0 on crates.io (not in 5.0.0), and the fix (fix: don't pre-allocate the declared size in the legacy decoders zip-rs/zip2#991) was merged on 2026-09-16, after 9.0.0-pre3.
  • GHSA-8hxf-qr8p-62x4 (moderate, CVE-2026-115906): AES HMAC not checked on early EOF or for empty entries. >= 0.6.0, < 9.0.0. AesReaderValid::read in 9.0.0-pre3 still returns Ok(0) on a short read without checking the tag, so the 9.0.0 pre-releases are affected.

Links to upstream issue(s) or PR(s)

• GHSA-m665: zip-rs/zip2@8068ab4 (adds enforce_header_consistency and ZipArchive::validate_header_consistency), released in 9.0.5.
• GHSA-hjqx: zip-rs/zip2@09c030e (resolve_enclosed in src/path.rs, checks in make_symlink).
• GHSA-9hj8: fix: don't pre-allocate the declared size in the legacy decoders zip-rs/zip2#991 (caps the preallocation at 1 MiB).
• GHSA-8hxf: zip-rs/zip2@ec265db (UnexpectedEof on a short read, HMAC check for empty entries).

Severity

CVSS 3.1 vectors are copied from the upstream advisories for hjqx, 9hj8 and 8hxf. GHSA-m665 only has a CVSS 4.0 vector upstream, so it has none here. crypto-failure for the AES one, since it is an authentication-tag bypass; privilege-escalation for the two that let an archive get files written where the application did not intend, as RUSTSEC-2026-0368 does. Happy to change any of these.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate: the zip maintainers published all four as GitHub repository advisories themselves.

The descriptions were written for this PR from the upstream advisories, the fix commits and the released source on docs.rs, not copied, so the files stay CC0.

Disclosure: these advisories were prepared with AI agents working for MV2 of Munim, Inc.
MV2, Munim, Inc. (mv2@munimtech.com)