---
id: CVE-2026-114102
title: >-
  adm-zip: adm-zip: Denial of Service via malformed ZIP archive decompression
  (CVE-2026-114102)
summary: >-
  A flaw was found in adm-zip. A remote, unauthenticated attacker could cause a
  Denial of Service (DoS) by submitting a malformed or corrupted ZIP archive to
  an application using asynchronous decompression. Because the library fails to
  prope…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-248
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - developer_hub
  - openshift_ai_rhoai
published: '2026-10-21'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T22:18:35+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114102.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114102.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-114102'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2557983'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-114102'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114102'
  - url: >-
      https://github.com/cthackers/adm-zip/security/advisories/GHSA-8238-w5pm-2374
  - url: >-
      https://www.vulncheck.com/advisories/adm-zip-before-0.6.1-denial-of-service-via-inflateasync-unhandled-error-event
tags:
  - csaf
  - vex
  - red-hat
  - exploit-available
  - cve.org
epss: 0.00455
epssPercentile: 0.39328
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/anywaye/nilepatch-admzip-dos'
  checkedAt: '2026-10-27T16:58:29.168Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-22T15:40:13.086058Z'
ingestedAt: '2026-10-21T01:37:08.014Z'
---

## Overview

A flaw was found in adm-zip. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by submitting a malformed or corrupted ZIP archive to an application using asynchronous decompression. Because the library fails to properly handle decompression stream errors, processing the invalid file triggers an unhandled exception that crashes the entire application process.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Developer Hub, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Developer Hub, Red Hat OpenShift AI (RHOAI) · updated 2026-10-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114102.json)

**adm-zip: adm-zip: Denial of Service via malformed ZIP archive decompression** — rated Important by Red Hat. Released 2026-10-21, updated 2026-10-22.

Affected:

- Red Hat Developer Hub
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Red Hat Developer Hub
- Red Hat OpenShift AI (RHOAI)

Not affected:

- Cost Management On Premise
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Build of Podman Desktop
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat OpenShift Container Platform 4
- Self-service automation portal 2

## Remediation

Affected