CVE-2024-48510 vulnerability is reported on DotNetZip version 1.11.1.000000 – Support | JetBrains

Problem:

Vulnerability management tools might report the DotNetZip.dll (a part of JetBrains.ReSharper.CommandLineTools.202X.Y.Z.zip bundle) library as vulnerable by CVE-2024-48510.

The information about this vulnerability was published on 13th Nov 2024 (as per the page on GitHub). It says the library versions >= 1.10.1, <= 1.16.0 are vulnerable.

Question:

Is the report valid and the DotNetZip.dll (part of JetBrains.ReSharper.CommandLineTools.202X.Y.Z.zip) is a real security risk? What versions are safe to use?

Answer:

In fact, JetBrains tools uses its own fork of the DotNetZip library: https://github.com/JetBrains/JetBrains.DotNetZip.Fork/tree/CVE-2024-48510.

The mentioned vulnerability was fixed by JetBrains engineers on the 2nd of May 2025. Our team ensured this vulnerability doesn't affect the newly built library and delivered the fix to public releases of our tools. The version of the library containing the fix is 11.1.1.0.

The following versions bundle a fixed version of DotNetZip.dll (11.1.1.0) that isn't vulnerable to CVE-2024-48510:

2024.2.9 released on the 28th May 2025;
2024.3.8 released on the 20th of May 2025;
2025.1.3 released on the 12th of June 2025 (and newer);
Any 2025.2 (released on the 14th of August 2025) and newer tools version;

The following versions bundle a vulnerable version of DotNetZip.dll (11.1.0.0) and are risky for usage. Consider updating the ReSharper tools if the version you use falls into one of these categories:

Any 2024.1 and older tools version;
From 2024.2 to 2024.2.8;
From 2024.3 to 2024.3.7;
From 2025.1 to 2025.1.2;

Question 2:

Meantime, the vulnerability management tools still might report the mentioned tool bundles (for e.g. JetBrains.ReSharper.CommandLineTools.2025.3.0.4.zip) containing the DotNetZip.dll as vulnerable. But it is said above it is safe to use. What does it mean?

Answer 2:

If the tool version you use matches the version listed above (as "isn't vulnerable"), the report is a false positive. GitHub Security Advisor only checks the artifact name and version and doesn't check the executable code itself. When JetBrains delivered a fix in its own fork, we updated the .dll version from 11.1.0.0 to 11.1.1.0. Still, the GHSA reports the .dll as vulnerable because the 11.1.1.0 is still in the range of affected versions: >= 1.10.1, <= 1.16.0.

You might want to double-check the .dll version via file properties or any assembly explorer tool. If the version is 11.1.1.0, the report is false-positive:

Question 3:

Is it planned to deliver another fix to prevent false-positive warnings reported by vulnerability management tools?

Answer 3:

Yes. Upon receiving another complaint about this issue (false-positive report) in December 2025, we had an internal discussion on this. Our team agreed to get rid of the DotNetZip.dll dependency in the future releases. Starting from 2025.3.2 and 2026.1 versions, the ReSharper Command Line Tools bundle doesn't rely on DotNetZip.dll anymore (and doesn't bundle it). We removed this dependency.

Solution:

Download the updated tools bundle (JetBrains.ReSharper.CommandLineTools.202X.Y.Z.zip) from the Other Downloads or Download ReSharper page. If neither 2025.3.2 nor 2026.1 are available yet on the download page, it is not yet released. Please wait for the release announcement.