CVE-2026-114103
Description
A flaw was found in adm-zip. The asynchronous extraction mechanism fails to enforce maximum output size limits when decompressing files, bypassing decompression bomb protections. A remote attacker can exploit this flaw by submitting a specially crafted ZIP archive with an artificially small declared size, causing the application to consume excessive memory and resulting in a Denial of Service (DoS).
Statement
This flaw is assessed as a Moderate severity issue because successful exploitation results exclusively in memory exhaustion and service disruption, without allowing privilege escalation, data tampering, or unauthorized information disclosure. Within Red Hat offerings, the affected library is typically bundled as a nested dependency inside containerized services or build environments rather than exposed directly as an open network service. Impact is further constrained because an attack requires an end-user or workload to upload malicious archive content to a feature that specifically invokes non-blocking decompression, limiting the overall blast radius to the affected container or processing task.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
