CVE-2022-23596: Infinite loop in junrar

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-01 · updated 2026-06-17
Weakness: CWE-835

Description

Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.

Affected products

junrar: before 7.4.1 — fixed in 7.4.1

How to fix

Upgrade to a fixed version: junrar 7.4.1. Check the vendor advisory for mitigations.

References

https://github.com/junrar/junrar/commit/7b16b3d90b91445fd6af0adfed22c07413d4fab7
https://github.com/junrar/junrar/issues/73
https://github.com/junrar/junrar/security/advisories/GHSA-m6cj-93v6-cvr5
https://github.com/junrar/junrar/commit/7b16b3d90b91445fd6af0adfed22c07413d4fab7
https://github.com/junrar/junrar/issues/73
https://github.com/junrar/junrar/security/advisories/GHSA-m6cj-93v6-cvr5

Get alerted when CVE-2022-23596 or the next vulnerability affects your stack