ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-97370

Junrar is an open source Java RAR archive library.

Published Oct 15, 2026 · catalog updated Oct 15, 2026 · Junrar is an open

Check if you run it

No confirmed exploitation is on record for CVE-2026-97370. EPSS is 0.40%. Act only if a listed version of Junrar is an open is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Junrar is an open).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.40%
Remediation
Advisory link
Affected products
Maven com.github.junrar:junrar · maven com.github.junrar · vendor junrar junrar

### Summary Junrar's RAR virtual machine can be forced into a deterministic infinite loop while extracting a crafted RAR4 archive. The loop is intended to be bounded by , but jump instructions can bypass this limit when is called with a target instruction pointer greater than or equal to . An unauthenticated attacker who can provide a RAR archive to an application using can cause the extraction thread to spin forever, consuming CPU and blocking the process. The issue is a denial of service vulnerability, not remote code execution. ### Details The root cause is in . returns early when the target IP is outside the prepared VM program: When , this branch: - does not update ; - does not decrement ; - returns , so callers treat it as success. The handler and the other jump-like handlers discard the return value of and immediately the main VM loop: Because of the , execution also skips the loop-end accounting: As a result, a VM program containing a single instruction can freeze both and : 1. points to the instruction. 2. The jump target resolves to or larger. 3. returns before modifying or decrementing . 4. The caller ignores the return value and continues. 5. The same instruction is executed again forever. ### Impact This is a CPU denial of service vulnerability. Any application that uses junrar to extract untrusted RAR archives can have an extraction worker thread permanently blocked by a small crafted archive. In services that process uploads or attachments automatically, repeated submissions can exhaust worker capacity and degrade or stop archive-processing functionality. The RAR VM does not provide native code execution, reflection, or process execution primitives, and Java array bounds checks prevent escaping the VM memory array. The expected security impact is availability only.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Maven com.github.junrar:junrar0 → 7.6.1
  • maven com.github.junrarversion unspecified
  • vendor junrar junrarversion unspecified

How to fix CVE-2026-97370

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-97370. EPSS is 0.40%. Act only if a listed version of Junrar is an open is installed.

Which versions are affected?

Compare what you have installed with 0 → 7.6.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-835: Infinite Loop. EPSS 0.40%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · NIST NVD

    Detected

    Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues befo

  2. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    com.github.junrar:junrar fixed in 7.6.1

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    com.github.junrar:junrar fixed in 7.6.1

  4. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Summary Junrar's RAR virtual machine can be forced into a deterministic infinite loop while extracting a crafted RAR4 archive. The loop is intended to be bounded by , but jump instructions can bypass this limit when is called with a target instruction pointer greater than or equal to . An unauthenticated attacker who can provide a RAR archive to an application using can cause the extraction th

Sources

  • CVE.orgVulnerability recordCVE-2026-97370

    Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-97370

    30-day exploitation probability 0.4%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-h9h9-2rmf-rvhp

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-97370

    Junrar's RAR virtual machine can be forced into a deterministic infinite loop while extracting a crafted RAR4 archive. The RarVM.ExecuteCode loop is intended to be bounded by maxOpCount, but jump instructions can bypass this limit when setIP() is called with a target instruction pointer greater than or equal to codeSize. An unauthenticated attacker who can provide a RAR archive to an application u

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-97370

    Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-h9h9-2rmf-rvhp

    Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.