Zip2, a Rust ZIP library, contains an unbounded allocation flaw in the extraction routine that processes symbolic link target sizes based on an attacker‑controlled ZIP64 uncompressed_size field. The flaw uses Vec::with_capacity to pre‑allocate storage for a symlink target, and if the size requested is too large, the allocation fails through the infallible path and aborts the process before the entry is validated. This results in a denial of service rather than data corruption. The weakness is represented by CWE‑400 (Uncontrolled Resource Consumption) and CWE‑789 (Memory Allocation).

The vulnerability affects the zip‑rs zip2 library for Rust, with affected releases spanning from version 1.3.0 through 8.9.x, until the issue is fixed in version 9.0.0. Systems that include any of these versions as a dependency are vulnerable.

The CVSS score of 7.5 indicates a high risk. EPSS is not available, so exploitation probability is undetermined, and the vulnerability is not listed in the CISA KEV catalog. An attacker can supply a malicious ZIP archive containing an overly large symlink target size, triggering the abort or memory exhaustion during extraction. The failure is not catchable in a different thread or with catch_unwind, allowing repeated denial of service in applications that process ZIP files.