CVE-2026-115906: CVE-2026-115906: AES Entry HMAC Authentication Bypass in Rust zip Crate

Two vulnerabilities were identified in the Rust zip crate. CVE-2026-115906 is a cryptographic authentication bypass in versions 0.6.0 to 9.0.0, where HMAC-SHA1-80 tags are only validated when the data_remaining counter reaches zero, allowing crafted archives to bypass checks via premature EOF. CVE-2026-115909 affects versions 1.3.0 to 9.0.0, enabling process aborts. This occurs when ZipArchive::extract passes untrusted uncompressed_size values to Vec::with_capacity during symbolic link extraction, causing excessive memory allocation from crafted ZIP64 fields.