rardecode: DoS risk due to unrestricted RAR dictionary sizes
rardecode versions <= 2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.
02 / AFFECTED SOFTWARE
Affected packages
8 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.
DoS risk due to unrestricted RAR dictionary sizes in github.com/nwaples/rardecode
rardecode versions <= 2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.
05 / REFERENCES
Further evidence
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11579.json
- https://github.com/nwaples/rardecode/commit/52fb4e825c936636f251f7e7deded39ab11df9a9
- https://nvd.nist.gov/vuln/detail/CVE-2025-11579
- https://github.com/advisories/GHSA-rwvp-r38j-9rgg
- https://github.com/nwaples/rardecode
- https://pkg.go.dev/vuln/GO-2025-4020