Bug 2566258

Summary:	CVE-2026-115905 maturin: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE [epel-all]
Product:	[Fedora] Fedora EPEL	Reporter:	aedmond
Component:	maturin	Assignee:	Fabio Valentini <decathorpe>
Status:	ASSIGNED ---	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	epel10	CC:	code, decathorpe, python-packagers-sig, rust-sig
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["a882e4b9-4d3a-421b-86d5-9f3fd525c169"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2563560
Bug Blocks:	2560934

Description aedmond 2026-11-03 20:18:43 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.

Comment 1 Ben Beasley 2026-11-05 13:57:54 UTC

This will be fixed soon in EPEL10.4+ by updating rust-zip to 9.3.0 and maturin 1.16.0. There are quite a few other packages that need to be coordinated in the same update.

For EPEL10.3, even if we reasonably assume that the necessary Updates Policy exceptions can be obtained, due to the many other coordinated breaking changes involved in updating rust-zip to v9, I am not currently personally planning to attempt a backport.

For maturin in particular, upstream claims in https://github.com/PyO3/maturin/pull/3334 that there is no exposure to the APIs involved in this CVE.