ETK-2026-1925Zero's internal tracking ID, independent of the CVE number.
waiting for further signalsZero needs more public information before it can validate it.description
Rust zip through 9.0.4 can interpret ZIP entry names inconsistently between its central-directory and streaming readers. An attacker may bypass archive checks and cause files to be written under unexpected names when an application validates an archive with one reader and extracts it with the streaming reader. This requires the application to process an attacker-controlled archive in such a mixed-reader workflow.
mitigation
Upgrade rust zip to version 9.0.5. Until all deployments are updated, avoid extracting untrusted archives with the streaming reader after validating them with a central-directory-based reader.
fixed in 9.0.5
outcome
Contextual: an exploit technique exists, but no deterministic check could cover this one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-17 18:48Zghsa: trigger signal, started the run
- 2026-10-17 18:48Z
this entry in the feed
GET /api/v1/feed/ETK-2026-1925
{ "etk_id": "ETK-2026-1925", "cve_id": null, "display_id": "ETK-2026-1925", "ghsa_id": "GHSA-m665-v7pm-7grj", "euvd_id": null, "status": "published", "anchor_state": "awaiting_cve", "title": "ZIP header interpretation mismatch in Rust zip", "summary": "Rust zip through 9.0.4 can interpret ZIP entry names inconsistently between its central-directory and streaming readers. An attacker may bypass archive checks and cause files to be written under unexpected names when an application validates an archive with one reader and extracts it with the streaming reader. This requires the application to process an attacker-controlled archive in such a mixed-reader workflow.", "mitigation": "Upgrade rust zip to version 9.0.5. Until all deployments are updated, avoid extracting untrusted archives with the streaming reader after validating them with a central-directory-based reader.", "vendor": "rust", "product": "rust:zip", "affected": [ { "affected_notes": [], "affected_ranges": [ "<= 9.0.4" ], "ecosystem": "rust", "fixed_versions": [ "9.0.5" ], "package_name": "zip", "purl": "pkg:cargo/zip" } ], "cwes": [ 20 ], "cvss_score": 10, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "contextual", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 17.16965785, "t0_at": null, "signals": { "public_poc": { "at": "2026-10-17T18:48:34+00:00", "days": -4.121837672407407, "is_lower_bound": true, "measured_at": "2026-10-21T21:44:00.799408+00:00", "url": "https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj" }, "trigger_signal": { "at": "2026-10-17T18:48:34+00:00", "days": -4.121837672407407, "is_lower_bound": true, "measured_at": "2026-10-21T21:44:00.799408+00:00", "url": "https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj" } } }
published 2026-10-18 02:41Z
last change 2026-10-21 21:36Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.