Description
Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.
References (3)
Core 3
Core References
Third Party Advisory x_refsource_confirm
https://github.com/junrar/junrar/security/advisories/GHSA-m6cj-93v6-cvr5
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/junrar/junrar/issues/73
Patch, Third Party Advisory x_refsource_misc
https://github.com/junrar/junrar/commit/7b16b3d90b91445fd6af0adfed22c07413d4fab7
Scores
CVSS v3
7.5
EPSS
0.0036
EPSS Percentile
58.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-835
Status
published
Products (2)
com.github.junrar/junrar
0 - 7.4.1Maven
junrar_project/junrar
< 7.4.1
Published
Feb 01, 2022
Tracked Since
Feb 18, 2026