CVE-2025-11579Medium· 5.3▾ TwilightPoC availablegithub.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
1 GitHub repo
0.3% → 0.4%
Last analysed / modified upstream
github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.
rardecode <= 2.1.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/nwaples/rardecode/v2 < 2.2.0github.com/nwaples/rardecode <= 1.1.3Patched in:
github.com/nwaples/rardecode/v2 2.2.0Source: https://osv.dev/vulnerability/GHSA-rwvp-r38j-9rgg
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112399High· 8.7Pillow: APNG background disposal allocates full canvas before decompression bomb check
CVE-2026-105749Medium· 6.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-102820Medium· 6.2pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance
CVE-2026-77410High· 8.9RabbitMQ amqp091-go is a Go AMQP 0.9.1 client
CVE-2026-53716Medium· 6.5Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway
CVE-2026-112048Medium· 6.1libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count