CVE-2026-114103: falha de média gravidade em cthackers adm-zip
adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.4%
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
cthackers · adm-zipCVEs relacionadas — cthackers adm-zip
No mesmo produto, das mais perigosas para as menos.
CVE-2026-92000HIGHadm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed SizeEPSS 0.7%CVE-2026-77301HIGHadm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)EPSS 0.6%CVE-2026-114102HIGHadm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error EventEPSS 0.5%CVE-2026-114104HIGHadm-zip before 0.6.1 Duplicate ZIP Entry Name Validation BypassEPSS 0.3%CVE-2026-116137MEDIUMadm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent NamesEPSS 0.3%CVE-2026-102282HIGHadm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalationEPSS 0.2%