CVE-2026-97370

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97370
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97370.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97370
Aliases
Downstream
Published
2026-10-15T18:17:26Z
Modified
2026-10-28T11:21:53Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction
Details

Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-835"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97370.json"
}
References

Affected packages

Git / github.com/junrar/junrar

Affected ranges

Type
GIT
Repo
https://github.com/junrar/junrar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9fd65e3449274100f23dd6d9c592e7a12b788d36
Fixed
687a09c42f46066447faa9179ee11314ad6d9afb
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "7.6.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "687a09c42f46066447faa9179ee11314ad6d9afb"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v7.6.1",
            "range": [
                {
                    "fixed": "9fd65e3449274100f23dd6d9c592e7a12b788d36"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

junrar-0.*
junrar-0.6
junrar-0.7
junrar-1.*
junrar-1.0.0
junrar-2.*
junrar-2.0.0
junrar-3.*
junrar-3.0.0
junrar-3.1.0
junrar-3.1.1
junrar-4.*
junrar-4.0.0
v4.*
v4.0.0
v5.*
v5.0.0
v6.*
v6.0.0
v6.0.1
v7.*
v7.0.0
v7.1.0
v7.2.0
v7.3.0
v7.4.0
v7.4.1
v7.5.0
v7.5.1
v7.5.10
v7.5.2
v7.5.3
v7.5.4
v7.5.5
v7.5.6
v7.5.7
v7.5.8
v7.5.9
v7.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97370.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "212612427168954136074515660515160895939",
                "333284633474126963090873118965543713788",
                "88816422663534287231886230436990524192",
                "53538981677047103782657424749487215288",
                "20413969998371089139406215356098095823",
                "184685065814662958519449652638318095011",
                "316801605861315365098474411094245940923",
                "276059960736377778495368420423833714372",
                "44454483267895385131796828436309676576",
                "181704668427519258060514031464578334835",
                "158061296470343009615433917691372435297",
                "22989267452526262460953643209029505035",
                "80007674638239997665625541515338009287",
                "289512025157222582363961937204838716217",
                "148491649937308822309124997132250449337"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-97370-10499c4f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/junrar/junrar/commit/687a09c42f46066447faa9179ee11314ad6d9afb",
        "target": {
            "file": "src/test/java/com/github/junrar/AbnormalFilesTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "334918232588857546347973273651073279983",
            "length": 161
        },
        "id": "CVE-2026-97370-1630a8f0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/junrar/junrar/commit/687a09c42f46066447faa9179ee11314ad6d9afb",
        "target": {
            "file": "src/main/java/com/github/junrar/unpack/vm/RarVM.java",
            "function": "setIP"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "197016982173670919878159355477704090257",
                "192876612652463078833960520409123558938",
                "118370138052608083572864218009264287793",
                "283910222276570917012489359635140156127",
                "201224367206717219054543952506273446241",
                "180116346885828726583695523380479101432",
                "270512476580981708766994416110605214387",
                "87961382065143359296316608599075998389",
                "152636880904132458410880328430524958253",
                "227245280997289179369940625917357334334",
                "304555359511686289665165131123336269280",
                "8691065073771248676485847636032743857",
                "39420910539396879383189350628128490626",
                "256483244480671705117326767931766601567",
                "146414056745185886416839346073064516890",
                "35858614500115825740153308937697276679",
                "261162263083631247723170009683486538880",
                "51475838205082333104543895178450293436",
                "138324788901758679862600522391965149388",
                "74228744879618292352796531629030360852",
                "278758907626143254719666372516415422758",
                "79265100012460547517798191058820356592",
                "134220008476723326922721326887410383876",
                "78090268776224922653306506759597033432",
                "258262422198676642041550548125123799712",
                "324773017314940676725378863717269290030",
                "41021504411017298494782210073087259346",
                "197793904765084399539577468208052043816",
                "332865098224316088144849768510723676066",
                "24267496699435137444810840381994410607",
                "309161471479767393675230780555296180591",
                "222489529684286852779256924456717363619",
                "284018003856690312446988517410698796032",
                "299824062694378982941655431376619569607",
                "98233364721688673417187135076591871748",
                "77278565265976132374820076697706852709",
                "22242289063241577617603445553295690172",
                "134950091949116732417394590349508946474",
                "71654733627840951138585854226073074702",
                "164137635298876864916430499222810920932",
                "18579158704368664901984640966067988593",
                "320461808524987445818487789740279913415",
                "160903185330959271066676544490216179561",
                "133401933185819262707973074867000386880",
                "89798135628507072071477040904754934623",
                "333322573703885273896889785406373901591",
                "240629391662946868022603218555340139422",
                "294657736222829586637460064653129681554",
                "74288769899507930700606405088497045169",
                "142596491504367221234751069764438128762",
                "338357058185590344041310233820489847814",
                "267733503212065249516951998088091505459",
                "312234588893881251074525849647881270785",
                "230201633793908381241138178687021664222",
                "338357058185590344041310233820489847814",
                "267733503212065249516951998088091505459",
                "312234588893881251074525849647881270785",
                "230201633793908381241138178687021664222",
                "338357058185590344041310233820489847814",
                "267733503212065249516951998088091505459",
                "312234588893881251074525849647881270785",
                "230201633793908381241138178687021664222",
                "20959709963671077574319962188856822989",
                "180164877616243678860542065579369792786",
                "277020512280428081703227294807530958638",
                "313934007677274264159758894564650439348",
                "192159551618938693448413259164410450435",
                "290164922112929190249684607479885525397",
                "331552765197245004707796732380464616037",
                "36394095062130295509536285432111522651",
                "153359002449644156235070988846381226753",
                "219151077962347788968344177814161320018",
                "84067137928112427509987986888693987077",
                "17333140741779950122308587484000789499",
                "222951844399282820057467578708964778284",
                "188654282565070961364924815247241060420",
                "255842755823045681364505325676955490711",
                "189285218916293881581781936821423938326",
                "36182574398979252450566324181918974370",
                "72924194104268015734438121593674790306",
                "130150504677955906278249471356276688537",
                "332392236512265221091524774561704819109",
                "131637819843100321439007566595741430035",
                "113648512036126757890436355759244334609",
                "242507665495724099088503880454926318962",
                "191667221465055302049659172388403196842",
                "323858207238730952602545846922490082402",
                "13022903426165093743241326477557526469",
                "63190324702514664576968210910779935465",
                "259294095798225613318620167092845393479",
                "83044481160015848344499372209390849078",
                "59772488158819051456035584674167903548",
                "199680776236480881399091262799754035442",
                "38980891760988121368950772000406320530",
                "250287479185461053682051189589766353711",
                "214431562392243789919030585816299596728",
                "94985795215318919151135536504843737083",
                "114303319975570236362971389138453039809",
                "34666446272471492978037837800175220723",
                "162163294255377992208840130153237791750",
                "240029564641310312450085913531680183907",
                "295456976878883448407475628821434014064",
                "236943774188442678591764193085274041447",
                "262249096629732123504268532066738896828",
                "115356241840087978836193829712778206797",
                "207383960288930082131202824740136208466",
                "113648512036126757890436355759244334609",
                "242507665495724099088503880454926318962",
                "288389927866904515771828790212470911331",
                "51535088309357072891829979275388683352",
                "235076367146903003117186180729528649986",
                "283762492475500207302493700537593376806",
                "315156138942850215983790291700888523152",
                "18770752903818262089743878109350270693",
                "270352577494522690907507999896049740370",
                "65995568453647616864581183022750671475",
                "337834408151085197279126921223707651864",
                "149573134459430098094806818123483165534",
                "335037161733948685398436064430807870484",
                "47761756328362630850931188801535078826",
                "7186105128414582960421158331244262742",
                "65995568453647616864581183022750671475",
                "93111994632884957557522440373287222259",
                "282548936078423896707910162463938285876",
                "86755974152772646899405702441634949018",
                "209529352393568017086658328051067702382",
                "29679177219439094140411847577591385689",
                "193967648584204153982346167490498270860",
                "107716461227267269900300866645694107784",
                "315030719449083867829625364263773749327",
                "191251111034915112711991706246647660684",
                "191856425066016087279750099364030494174",
                "137714078749052682297308330090603899655",
                "251551848901554823803324418818470863947",
                "272012018118030427265707667084353982819",
                "306101501960602956649857581442319219488",
                "256830952604753388133355950166758903515",
                "61841206321746179696765584882915009483",
                "257888242214209688025454476913415865796",
                "235769883573022406083280739797460692104",
                "174534121446686483171886335444920823062",
                "282548936078423896707910162463938285876",
                "86755974152772646899405702441634949018",
                "205335212777823225584410044453168347163",
                "282347423501394063060112689451238540020",
                "209687931589776089371698567533548508326",
                "65932700415175080443965166465473655767",
                "315030719449083867829625364263773749327",
                "101474819940105262465009158123594713192",
                "43516849619983588547943770613974814546",
                "88200402382376762694339034750902451258",
                "53221714105414087645232213374159518471",
                "157136465120060627633597970154439785553",
                "39199206631301578558627291738988842996",
                "26053146517330076512215914496971135687",
                "6995030461447473266234527684307352071",
                "225681363879536165912201237049583453670",
                "267708366186899782532624677997186710526",
                "28771671874993390836819641106745259054",
                "61977440252272443214685056606567936123",
                "152061217230536742119826570579015390851",
                "200911934249458087686045353280942401417",
                "115063558153675668045734916874979715476",
                "34404427178683728731324211770331013896",
                "294198205528682384404876895624639674594",
                "311745624070262367444654684958719802750",
                "16494311459018237923412887846390102947",
                "194532674505580841278133825322427643157",
                "281545699417008029270905921652044475560",
                "76344583205336705069376765295893488159",
                "249699930364339444900734064232680647172",
                "34404427178683728731324211770331013896",
                "294198205528682384404876895624639674594",
                "101463791107168292935235300806851191841",
                "246929063140319904176623212881348859446",
                "203569706190880969337810355151484669213",
                "193826282832632130367065014390537992620",
                "276375524354376054239796949969726343061",
                "185956369621020817721994528186239945603",
                "34404427178683728731324211770331013896",
                "294198205528682384404876895624639674594",
                "76476535346998488924720636057220981666",
                "12879948230227756805589702720876130049",
                "288763070117500041828326226694866649211",
                "285189817558363051380249620142782321490",
                "76344583205336705069376765295893488159",
                "130713390034286979120023680905309974494",
                "86755974152772646899405702441634949018",
                "161138910336401809638532683402970858251",
                "80289000402850959297380190195687159303",
                "267097641266138620326802928964095797901",
                "295155709100534702821751625564815326539",
                "67894793427503477097107398405058817829",
                "65995568453647616864581183022750671475",
                "231665675165692396973851721045693829806",
                "211069269449034342492844206327139286396",
                "229874981540765012469017981833706539640",
                "185447368846348528823617751834893413885",
                "127813522339777398721218430336052245625",
                "65995568453647616864581183022750671475",
                "158392509255089422643202026786893436520",
                "301540062657174435286014080609699417921",
                "196027362573596509565489192785110990100",
                "244328518333825512947085486108472825106",
                "32400012925282106941345010101799738744",
                "65995568453647616864581183022750671475",
                "249490099741186846200802621551014560685",
                "119835802744191630931958264232698463143",
                "55571316065510268421069979251258706561",
                "119107478743563242598199414881606606645",
                "331598371329439942600208013378040304456",
                "65995568453647616864581183022750671475",
                "94125005795781357406604817605039854356",
                "294783332963997793747575923917664076798",
                "293559466661517066714111915305385255168",
                "271227852682295703658903018807003743546",
                "273352860182187915903773335230610625344",
                "65995568453647616864581183022750671475",
                "71352016008524063189799860023679300243",
                "162781793236457229899419787592938741947",
                "314057736623109693904655788282525665720",
                "55223055457752226698794589409750498982",
                "310623491029428942806479964220521813424",
                "65995568453647616864581183022750671475",
                "34453535356522098774935697930684856142",
                "217716334445612003626074490881590784299",
                "206449226505345288515247247585678758808",
                "121810685533092639077999825356164928924",
                "39007408752720697663385937293602381331",
                "7047733697154282584859830591078772892",
                "303366727697286510284536571307784378076",
                "245641051977095966842685457473121351225",
                "104888698230610657748536626769479380241",
                "216549580614313053039109817792990565272",
                "253209417544881651644432078553218246523",
                "111696939369902289411304180479902405701",
                "331259707932818432501615746626149511844",
                "28853466870651842986676823510664025252",
                "304818352457970962185982890990355017981",
                "219113326794359680079566914505488822279",
                "226778834312584929205509517877128466111",
                "294449339163416723950715246405731793787",
                "98038614146514618037533260118110804065",
                "326402688823222083027117436380323478460",
                "237079850369203130112904948531958807511",
                "81036703012788860474470254194995304470",
                "26594298330236735226775685622901424461",
                "1563146392735895725309150488778907777",
                "262657384402262434779745983604215516175",
                "148638049289223930655696626279709990995",
                "230669821307792530541818530522903979272",
                "208099407151216745164943151677035546062",
                "200092593455912443443698387375250209658",
                "14487913336337581707718988245087828188",
                "277794304338148920764287448381797380521",
                "158135783801544779307664373971684625203",
                "337486482737650388868410926142011484495",
                "148927866222305278838193175123380824987",
                "117075189053506487676322607149764404295",
                "225149407645303228439134864917052868956",
                "148927866222305278838193175123380824987",
                "117075189053506487676322607149764404295",
                "53363658931176476468245026172745613355",
                "43005758662098187483040782544615733593",
                "275513505087847360074584789875206013866",
                "263845374238648457485663698836248880748",
                "166358065308526689058196179851163911005",
                "260146236705433672707579935123700756547",
                "179091158425203124543090168410814605744",
                "164552127839888904594083021561085791383",
                "217650221464341061508355229921450504214",
                "208206173248704964310844650938976651181",
                "175496878533308310189566471554193638573",
                "291625248696340347603174657666451952389",
                "256647735165211458387167993207308565136",
                "259430877848548751962502541752101464377",
                "172021120364262140029384354742526609028",
                "280409196009783830048226009875114225182",
                "170089712740320720389238470559822696100",
                "63916206543784488587526440639008920173",
                "287122408670667374320573304399575092998",
                "39415280138474860268599854965606862514",
                "192601061483255442467927413218923817448",
                "253618496154878508889981530190059119788",
                "140955532078859329987217349701316113201",
                "325318959032947412684519754762106283889",
                "75091890071263482840186939945775600705",
                "37706847694351273308303918483041208186",
                "122911687822573643213376458528451413013",
                "128565344359633922632768504826898259587",
                "30155457419637233491980046992611099118",
                "221302772800187344636307388161997557561",
                "68364758235967118940941834317667005956",
                "231417284753410570800932209216656207322",
                "194620780086225630939650962418657723493",
                "188894225870626509587773427905105786316",
                "38705779800760710642853752165960467668",
                "241834113071119635650963590267536220322",
                "115114342503483981436892886845932777820",
                "169256445410988778237802486526084510802",
                "133374593230559866834466670953415434413",
                "133683653874083543048071366893362631559",
                "221302772800187344636307388161997557561",
                "68364758235967118940941834317667005956",
                "64442300947513718175352640533558014863",
                "234296008115755313189535651261562167005",
                "173301221973781730185177503222295287495",
                "283956877692263122899958582809331241089",
                "2894000955075913658024517154435381320",
                "3457489717238983905071999960385261740",
                "311963734420105138556358423144362240606",
                "124296340145940191040741561127646483683",
                "50425867209713604744387711563766853648",
                "260052075303725312868204557559777064432",
                "280013221543843525336082698491461127522",
                "33948276052232630490740143350406799851",
                "146198054008288461892435252918156459287",
                "117411872068655294086643556945249353032",
                "107283685251479955552495806908009568337",
                "60334702613616154291086005201594175479",
                "194400843563139122515490670466313866000",
                "185731921236995702955385452003563189203",
                "33586180436673879542790854120997225531",
                "280337675386075896164833310578662033355",
                "105170602165748856036235447271003136879",
                "323187510537649011842764315577449439999",
                "84791101379153932586046621935519759303",
                "136114686407775907912189115147782058015",
                "196332673557115217328567811368185184124",
                "230042834320199719622762264103150964240",
                "136970859575320069277234360762266530663",
                "323483661436456410166004435024980294904",
                "304255066391228725127723289947074101611",
                "267027720549900394213132302885406283647",
                "280644581398567140759496612629991436303",
                "171987078064642335882542684790148014317",
                "16265572758397982952061782118268439515",
                "109054870514949853330124896605167322468",
                "53428164457044668778129623957975248211",
                "124661517705981024546287751743494669212",
                "213401734244345351676824123415156246699",
                "227366537380182505819354418938997936430",
                "256311939633087981655784906337978464728",
                "149463689072401757777358656994776513478",
                "232535965622639292925168690809114723939",
                "6213997093391438849454853248064589117",
                "110213243301162744710061200716609407331",
                "40617600707414462379750108308367171858",
                "312920146985866991968789651705769789805",
                "191004838938651199626835211604673476056",
                "283479873685713991502858687182786655641",
                "184440219951705263778490511418774158897",
                "162373256648968662276429430981168902201",
                "265953983295858045993147808283095814371",
                "126016330281369149625243050124551662064",
                "32616302118056154487639470998092198535",
                "250266000688100139531175508365856187860",
                "253075881658461212534319229794387032891",
                "336582428419491621448106237533247260494",
                "140612978712151985479798544183511824794",
                "32764675610351387736986527200127350709",
                "189132841203306316146932159348323138420",
                "93531943848785081710333147263317181004",
                "29384344121761899825484734518427291977",
                "194249114209712264255983788892794183586",
                "123600516401816871742702603034461103722",
                "122945266095358189120751141102812804164",
                "276654163423411172859250273340746002538"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-97370-8cbeaae0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/junrar/junrar/commit/687a09c42f46066447faa9179ee11314ad6d9afb",
        "target": {
            "file": "src/main/java/com/github/junrar/unpack/vm/RarVM.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "132927579719515997131817622450807703520",
            "length": 11458
        },
        "id": "CVE-2026-97370-f31798eb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/junrar/junrar/commit/687a09c42f46066447faa9179ee11314ad6d9afb",
        "target": {
            "file": "src/main/java/com/github/junrar/unpack/vm/RarVM.java",
            "function": "ExecuteCode"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:21:53Z"