AIKIDO-2026-272676

TL;DR

adm-zip caps decompression output at an entry's declared uncompressed size to limit decompression bombs, but skips the cap entirely when the declared size is 0. A crafted archive that declares its uncompressed size as zero decompresses without any limit, so a tiny payload expands to gigabytes and exhausts memory. This bypasses the earlier decompression-bomb protection. The fix enforces a minimum one-byte cap so a zero-size declaration can no longer disable the limit.