CVE-2022-23596 - CVE House
Back to Database
Status published High CVE-2022-23596

Infinite loop in junrar

Vulnerability Description

Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23596

Credits & Attribution

No credits recorded in the NVD database.

References

More from junrar project

View All →
CVE-2018-12418
Archive.java in Junrar before 1.0.1, as used in Apache Tika...
Medium 5.5

Affected Vendor

junrar project

View all reports →

Affected Software

junrar
Vulnerable Versions:
0

Timeline

Official Publish: February 1st, 2022
Last Modified: May 5th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.