CVE-2026-97370High· 7.5▾ TwilightJunrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepare…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
com.github.junrar:junrar <= 7.6.0Patched in:
com.github.junrar:junrar 7.6.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86071Low· 3.7Junrar is an open source Java RAR archive library
CVE-2026-41245Medium· 5.9Junrar is an open source java RAR archive library
CVE-2026-106121Medium· 4.9The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
CVE-2026-81876High· 7.5HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java
CVE-2022-49317Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid infinite loop to flush node pages xfstests/generic/475 can give EIO all the time which give an infinite loop to flush node page like below
CVE-2025-21850Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: nvmet: Fix crash when a namespace is disabled The namespace percpu counter protects pending I/O, and we can only safely diable the namespace once the counter drop to z…