Rardecode
Monthly
Out-of-memory denial of service affects applications that use the Go library github.com/nwaples/rardecode 2.1.1 and earlier to unpack RAR archives: a crafted archive can declare an oversized dictionary (window) size that the decoder allocates without enforcing a per-call bound, exhausting memory and crashing the process. Exploitation requires the target application to open the attacker-supplied archive (CVSS UI:R); no credentials are needed on the attacker side (PR:N), and the impact is availability-only (C:N/I:N/A:H, CVSS 6.5). Risk is genuine but moderate: EPSS is 0.37% (29th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis - deployments that never ingest externally controlled RAR files are effectively unaffected.
Out-of-memory denial of service affects applications that use the Go library github.com/nwaples/rardecode 2.1.1 and earlier to unpack RAR archives: a crafted archive can declare an oversized dictionary (window) size that the decoder allocates without enforcing a per-call bound, exhausting memory and crashing the process. Exploitation requires the target application to open the attacker-supplied archive (CVSS UI:R); no credentials are needed on the attacker side (PR:N), and the impact is availability-only (C:N/I:N/A:H, CVSS 6.5). Risk is genuine but moderate: EPSS is 0.37% (29th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis - deployments that never ingest externally controlled RAR files are effectively unaffected.