Vulnerability GHSA-m6cj-93v6-cvr5
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 years ago
February 01, 2022 at 12:47 AM UTC
Junrar vulnerable to infinite loop via extracting carefully crafted RAR archive
0.7 - 7.4.0
0.7 - 7.4.0
Summary
Junrar vulnerable to infinite loop via extracting carefully crafted RAR archive
Details
Impact
A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users.
Patches
The problem is partially patched in 7.4.1
Workarounds
None
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
6 hours ago
Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction
0.7 - 7.6.0 GHSA-h9h9-2rmf-rvhp
0.7 - 7.6.0 GHSA-h9h9-2rmf-rvhp
Low Risk
28 days ago
Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root
0.7 - 7.6.0 GHSA-89m4-43j5-vhhx
0.7 - 7.6.0 GHSA-89m4-43j5-vhhx
Medium Risk
6 months ago
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
0.7 - 7.5.9 GHSA-hf5p-q87m-crj7
0.7 - 7.5.9 GHSA-hf5p-q87m-crj7
Medium Risk
7 months ago
Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix
0.7 - 7.5.7 GHSA-j273-m5qq-6825
0.7 - 7.5.7 GHSA-j273-m5qq-6825
Medium Risk
8 years ago
Junrar vulnerable to Infinite Loop
0.7 - 1.0.0 GHSA-5xqr-grq4-qwgx
0.7 - 1.0.0 GHSA-5xqr-grq4-qwgx
Impacted packages
Timeline
Published
4 years ago
February 01, 2022 at 12:47 AM UTC
Fixed (7.4.1)
Unknown
Unknown
Last Modified
1 month ago
September 10, 2026 at 03:49 AM UTC