CVE-2026-97370: Junrar Denial of Service Vulnerability Due to Infinite Loop in RAR4 Extraction
Summary
CVE-2026-97370: Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction. Affects com.github.junrar:junrar versions < 7.6.1. Fixed in 7.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Junrar is an open-source Java library designed for extracting RAR archives. It provides a simple API for developers to integrate RAR file extraction capabilities into their applications. The library is widely used due to its efficiency and ease of use. However, it has a vulnerability that can lead to denial of service, particularly when handling crafted RAR4 archives, making it critical for users to be aware of this issue.
Vulnerability Detail
The vulnerability arises from Junrar's RAR virtual machine, which can enter a deterministic infinite loop during the extraction of a specially crafted RAR4 archive. The loop is supposed to be limited by the 'maxOpCount' parameter, but certain jump instructions can bypass this limit. An attacker can exploit this by providing a malicious RAR archive to an application using the 'Junrar.extract()' method, causing the extraction thread to consume CPU indefinitely and block the process. This results in a denial of service, affecting the availability of the application without allowing remote code execution.
How To Fix
Latest published version: 8.1.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.6.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted RAR4 archives until the package is updated. Implement input validation to ensure that only trusted sources are allowed to submit RAR files for extraction.
Conclusion
The Junrar library has a significant denial of service vulnerability (CVE-2026-97370) that can be exploited through crafted RAR4 archives. Users are advised to update to version 7.6.1 or later to mitigate this risk. Awareness and prompt action are essential to maintain application availability.
See every vulnerability recorded for com.github.junrar:junrar →
FAQ
CVE-2026-97370 is a vulnerability in the Junrar library that allows an attacker to cause a denial of service by exploiting an infinite loop during RAR4 extraction.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities based on your pom.xml without requiring signup.
The main consequence is a denial of service, where the application can become unresponsive due to excessive CPU usage caused by the infinite loop.
Yes, the vulnerability has been patched in version 7.6.1 of the Junrar library. It is recommended to update to this version or later.
No, this vulnerability is limited to denial of service and does not allow for remote code execution or other security breaches.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.github.junrar:junrar.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
