CVE-2018-12418: Junrar Infinite Loop Denial of Service Vulnerability
Summary
CVE-2018-12418: Junrar vulnerable to Infinite Loop. Affects com.github.junrar:junrar versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Junrar is a Java library that provides functionality for extracting files from RAR archives. It is commonly used in applications like Apache Tika. The library allows users to handle RAR files and extract their contents. However, versions prior to 1.0.1 are vulnerable to a denial of service attack due to an infinite loop when processing corrupt RAR files.
Vulnerability Detail
The vulnerability in Junrar arises from a flaw in the Archive.java file. When encountering corrupt RAR files, the library enters an infinite loop, causing a denial of service condition. This vulnerability can be exploited by an attacker who can provide a specially crafted RAR file to the application. The impact of this vulnerability is that it consumes excessive CPU resources, leading to a degradation in system performance and potentially causing the application to become unresponsive.
How To Fix
Latest published version: 8.1.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Junrar is not immediately feasible, a workaround can be implemented by implementing input validation checks before processing RAR files. This can involve verifying the integrity of the RAR file and ensuring it is not corrupt before attempting to extract its contents. By implementing proper input validation, the application can avoid triggering the infinite loop and mitigate the risk of a denial of service attack.
Conclusion
The Junrar library prior to version 1.0.1 is vulnerable to an infinite loop denial of service attack when handling corrupt RAR files. To mitigate this vulnerability, it is recommended to upgrade to the latest version of the library or implement input validation checks. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for com.github.junrar:junrar →
FAQ
Junrar is a Java library used for handling RAR files and extracting their contents.
The vulnerability can lead to a denial of service condition, causing excessive CPU usage and potentially making the application unresponsive.
Upgrade to version 1.0.1 or later of the Junrar library, which includes a fix for the infinite loop issue.
Implement input validation checks to ensure the integrity of RAR files before processing them.
There are no known public exploits for this vulnerability at the moment.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.github.junrar:junrar.
