Hi,

The following vulnerabilities were published for rust-zip.

CVE-2026-115905[0]:
| zip is a zip library for Rust that supports reading and writing
| simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory
| File Header filenames as authoritative while ZipStreamReader
| extracts using Local File Header filenames without reconciling the
| duplicate metadata in src/read/stream.rs. A crafted archive can
| therefore appear benign to a component that inspects the central
| directory but cause a streaming extractor to write a different
| attacker-selected path and content, potentially overwriting files
| used by a downstream service. This issue is fixed in version 9.0.5.


CVE-2026-115906[1]:
| zip is a zip library for Rust that supports reading and writing
| simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in
| src/aes.rs verifies its HMAC only when the attacker-controlled data
| counter reaches zero. If the underlying bounded reader reaches the
| real end of the archive while data_remaining is still positive, or
| if an encrypted entry has no payload, the reader can return a clean
| end of stream without reading and comparing the authentication tag.
| Applications using by_index_decrypt, by_name_decrypt,
| by_path_decrypt, or password-enabled by_index_with_options can
| therefore accept modified plaintext without an authentication error.
| This issue is fixed in version 9.0.0.


CVE-2026-115907[2]:
| zip is a zip library for Rust that supports reading and writing
| simple ZIP files. From 5.1.0 until 9.0.0, applications built with
| the legacy-zip feature can reserve output capacity from an attacker-
| controlled ZIP64 uncompressed size before validating the compressed
| stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic
| with a capacity overflow during ZipArchive::extract, and the Reduce
| and Implode decoders contain the same unbounded preallocation
| pattern. An unhandled panic can terminate an archive-processing
| service. This issue is fixed in version 9.0.0.


CVE-2026-115909[3]:
| zip is a zip library for Rust that supports reading and writing
| simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in
| src/read/mod.rs calls Vec::with_capacity for a symbolic link target
| using the attacker-controlled ZIP64 uncompressed_size before reading
| entry data. A small archive can request an impossible capacity,
| causing the infallible allocation path to abort the process before
| the entry is validated. The failure cannot be contained with
| catch_unwind or a worker thread, allowing repeated denial of service
| in archive-processing applications. This issue is fixed in version
| 9.0.0.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-115905
https://www.cve.org/CVERecord?id=CVE-2026-115905
[1] https://security-tracker.debian.org/tracker/CVE-2026-115906
https://www.cve.org/CVERecord?id=CVE-2026-115906
[2] https://security-tracker.debian.org/tracker/CVE-2026-115907
https://www.cve.org/CVERecord?id=CVE-2026-115907
[3] https://security-tracker.debian.org/tracker/CVE-2026-115909
https://www.cve.org/CVERecord?id=CVE-2026-115909

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore