---
id: CVE-2025-11579
title: "github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading\_large RAR\_dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory…"
summary: "github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading\_large RAR\_dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory…"
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-789
vendor: nwaples
product: rardecode
affected:
  - rardecode <= 2.1.1
patched:
  - github.com/nwaples/rardecode/v2 2.2.0
published: '2025-10-10'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T13:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-11579'
references:
  - url: >-
      https://github.com/nwaples/rardecode/commit/52fb4e825c936636f251f7e7deded39ab11df9a9
    label: responsibledisclosure@mattermost.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-11579.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-11579'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2403068'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-11579'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-11579'
  - url: 'https://github.com/nwaples/rardecode'
  - url: 'https://pkg.go.dev/vuln/GO-2025-4020'
tags:
  - nvd
  - exploit-available
  - csaf
  - vex
  - red-hat
  - osv
  - go
epss: 0.00374
epssPercentile: 0.31557
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/shinigami-777/PoC_CVE-2025-11579'
  checkedAt: '2026-11-05T15:16:22.096Z'
exploitAvailable: true
aliases:
  - GHSA-rwvp-r38j-9rgg
  - GO-2025-4020
ecosystem: go
ingestedAt: '2026-08-07T19:14:17.690Z'
---

## Overview

github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.

## Affected

- `rardecode <= 2.1.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-11579)

Affected packages:

- `github.com/nwaples/rardecode/v2 < 2.2.0`
- `github.com/nwaples/rardecode <= 1.1.3`

Patched in:

- `github.com/nwaples/rardecode/v2 2.2.0`

Source: https://osv.dev/vulnerability/GHSA-rwvp-r38j-9rgg

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: OpenShift Serverless, Red Hat Advanced Cluster Security 4, Red Hat OpenShift Container Platform 4, Red Hat Trusted Application Pipeline · no fix planned: OpenShift Serverless, Red Hat Advanced Cluster Security 4, Red Hat OpenShift Container Platform 4, Red Hat Trusted Application Pipeline · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-11579.json)