Description
github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nwaples | rardecode | 2.0.1 – ≤ 2.1.1 | 2.2.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-nwaples-rardecode | 2.2.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-nwaples-rardecode | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-nwaples-rardecode | No fix yet | — |
| Ubuntu 25.10 | golang-github-nwaples-rardecode | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20251105T184115-1.1 | openSUSE-SU-2025:15710-1 |
| openSUSE Tumbleweed | hauler | 1.3.1-1.1 | openSUSE-SU-2025:15722-1 |
| openSUSE Tumbleweed | jfrog-cli | 2.104.1-1.1 | openSUSE-SU-2026:10844-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 16.0 | hauler | 1.3.1-bp160.1.1 | openSUSE-SU-2025:20160-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | chezmoi | 2.66.0-r1 | — |
| Wolfi rolling | filebrowser +1 | 2.44.0-r1 | — |
| Wolfi rolling | gitleaks | 8.28.0-r3 | — |
| Wolfi rolling | gptscript | 0.9.5-r17 | — |
| Wolfi rolling | grype | 0.100.0-r1 | — |
| Wolfi rolling | guac +2 | No fix yet | — |
| Wolfi rolling | k9s | 0.50.15-r1 | — |
| Wolfi rolling | kots +2 | 1.128.2-r1 | — |
| Wolfi rolling | kubescape | 3.0.41-r1 | — |
| Wolfi rolling | nuclei | 3.4.10-r3 | — |
| Wolfi rolling | syft | 1.33.0-r1 | — |
| Wolfi rolling | trufflehog | 3.90.8-r2 | — |
| Wolfi rolling | undock | 0.10.0-r6 | — |
| Wolfi rolling | wolfictl | 0.38.18-r2 | — |
| Wolfi rolling | zarf | 0.63.0-r2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
shinigami-777/PoC_CVE-2025-11579 ★ 0 · Oct 19, 2025
Proof of Concept for CVE-2025-11579
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/nwaples/rardecode | <= 1.1.3 | — | GHSA-rwvp-r38j-9rgg |
| Go | github.com/nwaples/rardecode | all versions | — | GO-2025-4020 |
| Go | github.com/nwaples/rardecode/v2 | < 2.2.0 | 2.2.0 | GHSA-rwvp-r38j-9rgg |
Advisories 5
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- openSUSE-SU-2026:10844-1 jfrog-cli-2.104.1-1.1 on GA media SUSE / openSUSE Security Updates · May 24, 2026
- openSUSE-SU-2025:20160-1 Security update for hauler SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15722-1 hauler-1.3.1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15710-1 govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026