zip-rs zip2

• CVE-2026-115909 High 7.5 zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction 0.5%
• CVE-2026-115908 High 7.4 zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) 0.4%
• CVE-2026-115907 High 7.5 zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size 0.4%
• CVE-2026-115906 Medium 6.5 zip: AES Entry HMAC Authentication Bypass on Premature EOF 0.2%
• CVE-2026-115905 Critical 10.0 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE 0.3%
• CVE-2025-29787 High 7.3 zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write 0.6%