CVE-2022-23596: Junrar Vulnerable to Infinite Loop via Extracting Crafted RAR Archive
Summary
CVE-2022-23596: Junrar vulnerable to infinite loop via extracting carefully crafted RAR archive. Affects com.github.junrar:junrar versions < 7.4.1. Fixed in 7.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Junrar is a Java library that provides functionality for extracting files from RAR archives. It is commonly used in applications that handle compressed files. The library allows users to extract files from RAR archives, but a vulnerability has been discovered that can lead to an infinite loop when extracting a carefully crafted RAR archive.
Vulnerability Detail
The vulnerability in Junrar arises from a flaw in the library's handling of certain RAR archives. An attacker can create a specially crafted RAR archive that triggers an infinite loop during the extraction process. The impact of this vulnerability depends on how the application using Junrar handles extracted files and whether malicious users can provide the RAR archives. If an application is vulnerable and processes malicious RAR archives, it may enter an infinite loop, causing denial of service or resource exhaustion. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 8.1.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The only effective solution is to update the Junrar library to a patched version.
Conclusion
Junrar is vulnerable to an infinite loop vulnerability when extracting carefully crafted RAR archives. The impact of this vulnerability depends on the application's usage of Junrar and the ability of malicious users to provide RAR archives. It is crucial to update the Junrar library to version 7.4.1 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.github.junrar:junrar →
FAQ
Junrar is a Java library that provides functionality for extracting files from RAR archives.
The impact depends on how the application using Junrar handles extracted files and whether malicious RAR archives can be provided. If an application is vulnerable and processes malicious RAR archives, it may enter an infinite loop, causing denial of service or resource exhaustion.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix the vulnerability, update the Junrar library to version 7.4.1 or later.
No, there are no known workarounds for this vulnerability. Updating the Junrar library to a patched version is the only effective solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.github.junrar:junrar.
