CVE-2026-77301

A flaw was found in adm-zip, a JavaScript library for handling ZIP archives. The getData() function in zipEntry.js allocates memory based on the declared uncompressed size in a ZIP entry's central directory without validating this value against the actual compressed data. A remote attacker can exploit this by providing a specially crafted, small ZIP file that declares a multi-gigabyte uncompressed size. This can lead to excessive memory consumption, causing applications to terminate or suffer service-wide memory exhaustion, resulting in a Denial of Service (DoS).

Red Hat rates the impact of this vulnerability as Moderate because successful exploitation requires an application to ingest an untrusted archive and results solely in a denial of service through memory exhaustion, without compromising confidentiality or integrity. Within Red Hat environments, adm-zip is embedded as an internal dependency in containerized dashboards and developer utilities. As a result, excessive resource allocation remains constrained to the specific worker process or container parsing the file, mitigating wider system failure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.