Detections
Analytics

SCA: security update for adm-zip (GHSA-rcw4-f5rp-g42v)

high Tenable Self-Hosted Container Security Plugin ID 448478

Description

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

Solution

Update the adm-zip library and its related packages to version 0.6.1 or later.

See Also

https://github.com/advisories/GHSA-rcw4-f5rp-g42v

Plugin Details

Severity: High

ID: 448478

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/29/2026

Updated: 9/29/2026

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/29/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

cwe: CWE-409