CVE-2025-11579: rardecode: DoS risk due to unrestricted RAR dictionary sizes

October 10, 2025 (updated December 11, 2025)

rardecode versions <= 2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.

References

github.com/advisories/GHSA-rwvp-r38j-9rgg
github.com/nwaples/rardecode
github.com/nwaples/rardecode/commit/52fb4e825c936636f251f7e7deded39ab11df9a9
nvd.nist.gov/vuln/detail/CVE-2025-11579
pkg.go.dev/vuln/GO-2025-4020

Code Behaviors & Features

Detect and mitigate CVE-2025-11579 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →