TI-2022-07649 Aliases CVE-2022-23596 GHSA-m6cj-93v6-cvr5

Infinite loop in junrar

HIGH 72CWE-835Published 2022-02-01 · Updated 2025-05-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01632 76th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial com.github.junrar:junrar (Maven): 7.4.1Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	com.github.junrar:junrar (Maven)	before 7.4.1	7.4.1	Patch available	GHSA-m6cj-93v6-cvr5

— Vendor— Affected all versions Fixed in — No fix listed CNA
com.github.junrar:junrar (Maven) Vendor— Affected before 7.4.1 Fixed in 7.4.1 Patch available GHSA-m6cj-93v6-cvr5

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:junrar_project:junrar::::::::	before 7.4.1	Vulnerable	Junrar Project

cpe:2.3:a:junrar_project:junrar:*:*:*:*:*:*:*:* Versions before 7.4.1 Vulnerable ·Junrar Project

Remediation

Fix · GHSA-m6cj-93v6-cvr5 com.github.junrar:junrar (Maven) Fixed in 7.4.1 Advisory →

Red Hat 1 advisory

RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
Red Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat BPM Suite 6	Affected	No fix planned: Out of support scope
Red Hat Integration Camel K 1	Affected	No fix yet
Red Hat JBoss BRMS 6	Affected	No fix planned: Out of support scope
Red Hat Fuse 7.11	Fixed	RHSA-2022:5532

Timeline

2026-10-02 Threatist record created from CVE-2022-23596
2026-10-03 Alias added: GHSA-m6cj-93v6-cvr5

References

Exploit 1

https://github.com/junrar/junrar/issues/73

Patch 1

https://github.com/junrar/junrar/commit/7b16b3d90b91445fd6af0adfed22c07413d4fab7

Advisory 2

Other 1

https://github.com/junrar/junrar

TI-2026-22543 Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix CVSS 3.1MEDIUM 5.9
TI-2026-29854 Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix CVSS 3.1HIGH 7.5
TI-2018-08916 Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is… CVSS 3.0MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences