pyzipper has an encryption bypass for small files encrypted using it
Description
Impact
A Python operator precedence bug in pyzipper/zipfile_aes.py caused the AE-2 format to never be automatically selected during encryption, regardless of file size or compression type. As a result, all encrypted entries are written in AE-1 format unless AE-2 is explicitly forced by the caller. AE-1 stores the plaintext CRC32 checksum unencrypted in the ZIP header. During investigation of this issue, it was also found that when writing to an unseekable zip archive, the CRC32 value was always written to the datadescripter section.
The AES encryption itself is not broken. An attacker who possesses the archive can read the CRC32 from the header without decrypting anything, then brute-force candidate plaintexts by computing CRC32(candidate) and comparing against the stored value. In practice, this attack is feasible today only against small or low-entropy files, as CRC32 exhaustion across a large plaintext space is computationally prohibitive on current hardware. Files with high-entropy or large content are not practically at risk under current computing constraints. Without this bug, pyzipper would have removed the CRC32 value for any file with content of less than 20 bytes uncompressed.
Patches
Upgrade to pyzipper 0.4.0 that changes the default behaviour of pyzipper to always use the AE-2 format and exclude the CRC32 values, unless instructed to do otherwise.
If rewriting the zip archive to remove the CRC values for small files, the entire zip archive should be recreated to avoid the original local file header with the CRC included remaining in the zip file in a detached state.
Credit
Thanks to Lucas Lavarello from Kulkan Security for identifying this issue.
### References https://www.winzip.com/en/support/aes-encryption/#CRC https://www.winzip.com/en/support/aes-encryption/#crc-faq
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Pyzipper operator precedence bug prevents AE-2 format selection, exposing plaintext CRC32 in encrypted ZIP headers, enabling brute-force attacks on small/low-entropy files; fixed in v0.4.0.
A Python operator precedence bug in pyzipper's zipfile_aes.py causes the AE-2 encryption format to never be automatically selected, regardless of file size or compression type [2]. Consequently, all encrypted entries are written in AE-1 format, which stores the plaintext CRC32 checksum unencrypted in the ZIP header [2]. When writing to an unseekable archive, the CRC32 is also written to the data descriptor section [2].
An attacker with access to the encrypted archive can read the plaintext CRC32 from the header without decryption and perform a brute-force search over candidate plaintexts by comparing CRC32 values [2]. This attack is feasible only against small or low-entropy files because CRC32 exhaustion across a large plaintext space is computationally prohibitive on current hardware [2].
The impact is limited to leaking CRC32 checksums, allowing an attacker to verify guesses for small files, but the AES encryption itself remains intact [2]. Files with high entropy or large content are not practically at risk under current computing constraints [2].
The vulnerability is patched in pyzipper version 0.4.0, which changes the default behavior to always use AE-2 format and exclude CRC32 values unless explicitly overridden [1]. Users are advised to upgrade immediately and, for existing archives with small files, recreate the entire archive to remove CRC values from local file headers [2].
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pyzipperPyPI | < 0.4.0 | 0.4.0 |
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3News mentions
0No linked articles in our index yet.