Skip to content
Fencer Intel
no cvss —

RUSTSEC-2025-0172 json

`zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead

published last yr. modified 2mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The [`zip-extract`](https://crates.io/crates/zip-extract) crate has been explicitly deprecated by its author on [Jul 16, 2025](https://github.com/MCOfficer/zip-extract/commit/2950ec98d33b6e752b4f0976d67d89feb6f4acde), and the repository was archived on [Sep 8, 2025](https://github.com/MCOfficer/zip-extract).

The author added deprecation notices [README](https://github.com/MCOfficer/zip-extract/commit/2950ec98d33b6e752b4f0976d67d89feb6f4acde#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5R1-R8) stating that the functionality is now available directly in the [`zip`](https://crates.io/crates/zip) crate via [`ZipArchive::extract`](https://docs.rs/zip/8.6.0/zip/read/struct.ZipArchive.html#method.extract) (available since zip 0.6.0) and [`ZipArchive::extract_unwrapped_root_dir`](https://docs.rs/zip/8.6.0/zip/read/struct.ZipArchive.html#method.extract_unwrapped_root_dir) (available since zip 2.4.0).

If you are using [`zip-extract`](https://crates.io/crates/zip-extract), switch to the [`zip >= 2.4.0`](https://crates.io/crates/zip) crate and use the methods above instead.

Patch / fix

Is RUSTSEC-2025-0172 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io zip-extract
>=0.0.0-0
 no fix listed

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.