Vulnerability · Published Oct 10, 2025 · Assigned by Mattermost
CVE-2025-11579DoS via Out Of Memory Crash
Medium 5.3
In plain English
A medium-severity security flaw in rardecode from nwaples. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | golang-github-nwaples-rardecode | 2.2.1-1 | DEBIAN-CVE-2025-11579 |
| Go | github.com/nwaples/rardecode | no fix listed | GHSA-rwvp-r38j-9rgg |
| Go | github.com/nwaples/rardecode | no fix listed | GO-2025-4020 |
| Go | github.com/nwaples/rardecode/v2 | 2.2.0 | GHSA-rwvp-r38j-9rgg |
| Go | github.com/nwaples/rardecode/v2 | 2.2.0 | GO-2025-4020 |
| Ubuntu:25.10 | golang-github-nwaples-rardecode | no fix listed | UBUNTU-CVE-2025-11579 |
| Ubuntu:26.04:LTS | golang-github-nwaples-rardecode | no fix listed | UBUNTU-CVE-2025-11579 |
| Ubuntu:26.10 | golang-github-nwaples-rardecode | no fix listed | UBUNTU-CVE-2025-11579 |
Affected products (as reported)
Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L