{"id":"CVE-2026-114102","title":"adm-zip: adm-zip: Denial of Service via malformed ZIP archive decompression (CVE-2026-114102)","summary":"A flaw was found in adm-zip. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by submitting a malformed or corrupted ZIP archive to an application using asynchronous decompression. Because the library fails to prope…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-248","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["developer_hub","openshift_ai_rhoai"],"published":"2026-10-21","updated":"2026-10-22","sourceUpdated":"2026-10-22T22:18:35+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114102.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114102.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-114102"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557983"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114102"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114102"},{"url":"https://github.com/cthackers/adm-zip/security/advisories/GHSA-8238-w5pm-2374"},{"url":"https://www.vulncheck.com/advisories/adm-zip-before-0.6.1-denial-of-service-via-inflateasync-unhandled-error-event"}],"tags":["csaf","vex","red-hat","exploit-available","cve.org"],"epss":0.00455,"epssPercentile":0.39328,"exploits":{"github":1,"githubRepos":["https://github.com/anywaye/nilepatch-admzip-dos"],"checkedAt":"2026-10-27T16:58:29.168Z"},"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-22T15:40:13.086058Z"},"ingestedAt":"2026-10-21T01:37:08.014Z","slug":"CVE-2026-114102","body":"## Overview\n\nA flaw was found in adm-zip. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by submitting a malformed or corrupted ZIP archive to an application using asynchronous decompression. Because the library fails to properly handle decompression stream errors, processing the invalid file triggers an unhandled exception that crashes the entire application process.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Developer Hub, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Developer Hub, Red Hat OpenShift AI (RHOAI) · updated 2026-10-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114102.json)\n\n**adm-zip: adm-zip: Denial of Service via malformed ZIP archive decompression** — rated Important by Red Hat. Released 2026-10-21, updated 2026-10-22.\n\nAffected:\n\n- Red Hat Developer Hub\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Red Hat Developer Hub\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Cost Management On Premise\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Build of Podman Desktop\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Fuse 7\n- Red Hat OpenShift Container Platform 4\n- Self-service automation portal 2\n\n## Remediation\n\nAffected","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":227786,"id":"CVE-2026-114102","ts":1792706621138,"field":"exploit_available","old":"false","new":"true"}]}