Aug 6, 2026 · 8 min
OxiArc 0.4.1 Released — A Predictable ZIP Salt, a Wrong CRC Lane, and a Decompression Bomb, All Closed
OxiArc 0.4.1 is a security-hardening release: ZIP AES/ZipCrypto salts and headers now always come from a real OS CSPRNG (no more silent low-entropy fallback), WinZip-AES is now constant-time, a silently-wrong x86_64 CRC-32 SIMD path is fixed and enabled, and 7z folder coder chains are bounded against decompression-bomb amplification. Plus Zstandard FSE_Compressed_Mode sequence tables and Brotli literal/command/distance block splitting close two long-standing encoder-ratio gaps. 2,658 tests passing, Pure Rust.
releaseoxiarcsecurity