adm-zip versions 0.5.14 through 0.6.0 do not enforce the expected output limits when ZIP entries declare zero uncompressed size. This allows an attacker to craft a highly compressible archive whose entries specify a size of zero. When processed, the library expands the data without a size guard, eventually exhausting the application’s memory and crippling availability. The weakness is a resource exhaustion fault (CWE‑409) and improper allocation of memory (CWE‑770).

Affected software is the adm‑zip library distributed by cthackers. Versions from 0.5.14 up to and including 0.6.0 are vulnerable. No other packages or operating systems are listed; the vulnerability is confined to applications that embed these specific library releases.

The CVSS score of 8.7 classifies the issue as high severity. The EPSS score is below 1 %, indicating a very low probability that exploits are currently in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can deliver a malicious ZIP file to any hosting environment that uses adm‑zip to extract archives, making the attack vector external and inexpensive. Without mitigation, the denial of service could affect all instances that import untrusted ZIP data.