CVE-2026-114103

A flaw was found in adm-zip. The asynchronous extraction mechanism fails to enforce maximum output size limits when decompressing files, bypassing decompression bomb protections. A remote attacker can exploit this flaw by submitting a specially crafted ZIP archive with an artificially small declared size, causing the application to consume excessive memory and resulting in a Denial of Service (DoS).

This flaw is assessed as a Moderate severity issue because successful exploitation results exclusively in memory exhaustion and service disruption, without allowing privilege escalation, data tampering, or unauthorized information disclosure. Within Red Hat offerings, the affected library is typically bundled as a nested dependency inside containerized services or build environments rather than exposed directly as an open network service. Impact is further constrained because an attack requires an end-user or workload to upload malicious archive content to a feature that specifically invokes non-blocking decompression, limiting the overall blast radius to the affected container or processing task.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.