Bug 2566263

Summary: CVE-2026-115905 maturin: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE [fedora-all]
Product: [Fedora] Fedora Reporter: aedmond
Component: maturinAssignee: Fabio Valentini <decathorpe>
Status: ASSIGNED --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: rawhideCC: code, decathorpe, python-packagers-sig, rust-sig
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["a882e4b9-4d3a-421b-86d5-9f3fd525c169"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2563560    
Bug Blocks: 2560934    

Description aedmond 2026-11-03 20:19:25 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
Comment 1 Ben Beasley 2026-11-05 13:58:23 UTC 
This will be fixed soon by updating rust-zip to 9.3.0 and maturin to 1.16.0. There are quite a few other packages that need to be coordinated in the same update. For maturin in particular, upstream claims in https://github.com/PyO3/maturin/pull/3334 that there is no exposure to the APIs involved in this CVE.