archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructe

Description

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

Affected Products

References

• https://go.dev/cl/736713(Patch)
• https://go.dev/issue/77102(Patch)
• https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc(Release Notes)
• https://pkg.go.dev/vuln/GO-2026-4342(Vendor Advisory)
• http://www.openwall.com/lists/oss-security/2026/01/15/4(Exploit, Mailing List, Third Party Advisory)