CVE-2022-23596

Infinite loop in junrar

7.5 HighFix available

Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.63%Up 0.7 points since Feb 8, 2022

What each source reports

CVE List Score used 7.5

Infinite loop in junrar

Record: CVE-2022-23596
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-835
Updated: 2026-11-02

EUVDEUVD-2022-1093 7.5

Record: EUVD-2022-1093
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-m6cj-93v6-cvr5 7.5

Junrar vulnerable to infinite loop via extracting carefully crafted RAR archive

Impact

A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users.

Patches

The problem is partially patched in 7.4.1

Workarounds

None

References

https://github.com/junrar/junrar/issues/73

https://github.com/junrar/junrar/issues/81

Record: GHSA-m6cj-93v6-cvr5
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-835
Updated: 2026-11-02

NVD 7.5

Record: CVE-2022-23596
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-835
Updated: 2026-11-02

OSV 7.5

Infinite loop in junrar

Record: CVE-2022-23596
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-m6cj-93v6-cvr5 7.5

Junrar vulnerable to infinite loop via extracting carefully crafted RAR archive

Impact

Patches

The problem is partially patched in 7.4.1

Workarounds

None

References

https://github.com/junrar/junrar/issues/73

https://github.com/junrar/junrar/issues/81

Record: GHSA-m6cj-93v6-cvr5
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-835
Updated: 2026-11-02

Affected products

junrar project junrar

Affected packages

Affected packages
Package	Affected	Fixed
`com.github.junrar:junrar` Maven	before 7.4.1	7.4.1
`com.github.junrar:junrar` Maven	before 7.4.1, plus listed versions 0.71.0.01.0.12.0.03.0.0 Show 10 moreShow less 3.1.04.0.05.0.06.0.06.0.17.0.07.1.07.2.07.3.07.4.0	7.4.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-23596 is a high vulnerability (CVSS 7.5) in Junrar Project Junrar, published February 1, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.63%, the 76th percentile. Fixed in com.github.junrar:junrar 7.4.1.