CVE-2023-22899: ZIP4J Project ZIP4J

Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days.

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

Affected products

• ZIP4J Project ZIP4J: up to and including 2.11.2

Published 2023-01-10. Last modified 2026-06-17.