CVE-2026-77301: adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

September 18, 2026

adm-zip allocates an entry’s output buffer from the declared uncompressed size (central-directory size field) before validating it against the actual data. A tiny crafted ZIP that declares a huge uncompressed size forces a multi-gigabyte allocation from a few bytes.

References

github.com/advisories/GHSA-7q85-xj36-vmfc
github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6
github.com/cthackers/adm-zip/releases/tag/v0.6.1
github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc
nvd.nist.gov/vuln/detail/CVE-2026-77301

Code Behaviors & Features

Detect and mitigate CVE-2026-77301 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →