Multiple Vulnerabilities Identified with Reported Exploitation

Six vulnerabilities have been identified, including security control bypass, authentication bypass, denial of service, and path traversal issues.

CVE-2026-115905 involves a security control bypass via parser differential between central directory and local headers, with a CVSS score of 7.4. CVE-2026-115906 is an authentication bypass in AES encrypted entries due to improper HMAC verification, scoring 7.5 on the CVSS scale.

CVE-2026-115907 and CVE-2026-115909 both involve denial of service vulnerabilities. The former is due to unbounded memory allocation in legacy decoders, while the latter is caused by uncontrolled memory allocation on symlink targets. Both have a CVSS score of 7.5.

CVE-2026-115908 is a path traversal vulnerability via lexical symlink validation during extraction. CVE-2026-116591 involves a crafted zstd frame that causes DecodeAll and the streaming decoder to panic, with a CVSS score of 7.5.

Exploitation of these vulnerabilities has been reported.