CVE-2026-77301: adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

September 18, 2026

adm-zip allocates an entry’s output buffer from the declared uncompressed size (central-directory size field) before validating it against the actual data. A tiny crafted ZIP that declares a huge uncompressed size forces a multi-gigabyte allocation from a few bytes.

References

github.com/advisories/GHSA-7q85-xj36-vmfc
github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6
github.com/cthackers/adm-zip/releases/tag/v0.6.1
github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc
nvd.nist.gov/vuln/detail/CVE-2026-77301

Code Behaviors & Features

Detect and mitigate CVE-2026-77301 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →