CVE-2025-11579: nwaples rardecode
CVSS: 6.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2025-11579DEBIAN-CVE-2025-11579CGA-2762-mxmr-5674CGA-2m92-3v2j-jwj4CGA-2qv4-hcx7-q973CGA-2xjq-394q-g4wrCGA-36jg-7q5p-838pCGA-37qv-wv37-6jpmCGA-465p-hjqc-j543CGA-4j5r-3q2j-cx87CGA-4r6q-38xw-fcf9CGA-4rwg-3rpc-q4g6CGA-52q6-vpvv-mqrhCGA-6h3f-86v9-5g77CGA-7q86-9pc5-wv63CGA-93q5-f58c-36w2CGA-964j-xr2j-73x9CGA-98r2-vq77-xr75CGA-9jvr-v8fx-6j9jCGA-ch33-c3q2-8f9jCGA-f23x-q295-qqrfCGA-fhq3-9c7j-xhg9CGA-g22j-5fgh-24rvCGA-g253-m39v-6gjfCGA-gr94-q5h8-3v5qCGA-h4f4-6wfp-j265CGA-j4q9-jvwg-r9qgCGA-j79c-86v4-5fm2CGA-j9r2-x8j4-799qCGA-jvh9-wj8f-vq47CGA-mw3q-q8mr-6hfjCGA-p392-9fqf-62mvCGA-pwmv-vv2w-phj4CGA-q8p7-cpwm-cjwxCGA-qmw5-j7v4-ww3gCGA-r57r-3xfp-m8xxCGA-v3hq-4m7c-47g9CGA-v79r-598h-v3xpCGA-w2fc-3qjc-p2rwCGA-w9w7-74m3-j42wCGA-x23v-8gvj-7mmxCGA-x2wx-p749-f25qCGA-xqpq-9494-6jqxCGA-xwqg-3m4r-4657GHSA-rwvp-r38j-9rggGO-2025-4020openSUSE-SU-2026:10844-1CGA-27hq-x838-7w5xCGA-2jxj-987h-fv5vCGA-54vr-pj5w-gqc2CGA-5jrh-qmh7-gjc5CGA-5pqj-cw89-v94xCGA-5q6p-p6fv-655gCGA-5xcx-76qr-m892CGA-677x-gv8w-cchrCGA-6x3v-vvgv-83pqCGA-7qr5-vj5c-g2r5CGA-7x4c-x77r-5x33CGA-828x-h2ph-p46xCGA-88fc-qhrw-8jm5CGA-97qf-f7x8-qv35CGA-99r9-wr22-w8c5CGA-9m4x-72vx-g269CGA-9m82-3xpc-vp5jCGA-c245-wpx6-rm3hCGA-frg7-77ph-jqxcCGA-fw2p-635r-3w7fCGA-fxm5-q9m2-vr5cCGA-gch7-828v-vjf9CGA-ghpr-h49r-5wcrCGA-h6cw-x49q-3gvgCGA-h9fq-8vr2-xw9wCGA-hmhm-wc8f-5p5fCGA-j2wq-82gf-xjqxCGA-jccv-875q-r94hCGA-m4hm-hrr4-5x9wCGA-mchr-6h36-h9jwCGA-mr27-wf58-jpp5CGA-q326-mqmg-7gqfCGA-qgh2-cv2c-7gg9CGA-qgr9-76fh-4rjgCGA-qh39-wxxq-xc23CGA-v8cf-7764-5pmvCGA-v95j-x632-52j3CGA-v9wf-w223-r8q4CGA-w86j-mcpc-9v4fCGA-wgjh-rh83-jhwrCGA-wjrv-758x-rp5pCGA-wr5r-9wx6-g578CGA-x433-4q7q-8vhjCGA-xqmp-mv8g-x823
Published 10-10-2025Last modified 02-12-2025
Vulnerability summary
CVE-2025-11579 is a medium (CVSS 6.5) vulnerability in nwaples rardecode. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.9% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
0.37%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 15Timeline
- 10-10-2025PublishedVulnerability first disclosed.
- 02-12-2025Last modifiedVulnerability information updated.
Description
github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSources7 sources · 5.3–6.5
- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · GoEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
0.00 pp
From 0.37% on 20-09-2026
20-09-202620-10-2026
EPSS score0.37%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard46 products
- cg< 0_git20251010-r1
- chainctl< 0.2.158-r0
- chezmoi< 2.66.0-r1
- docker-credential-cgr< 0.2.158-r0
- filebrowser< 2.44.0-r1
Wolfi21 products
- chezmoi< 2.66.0-r1
- filebrowser< 2.44.0-r1
- filebrowser-compat< 2.44.0-r1
- gitleaks< 8.28.0-r3
- gptscript< 0.9.5-r17
Debian1 product
- golang-github-nwaples-rardecode< 2.2.1-1
Github.com/nwaples1 product
- rardecode≤ 1.1.3 | All versions (No fix recorded)
Github.com/nwaples/rardecode1 product
- v2< 2.2.0
Nwaples1 product
- rardecode≥ 2.0.1, ≤ 2.1.1 | ≤ 2.1.1
Opensuse1 product
- jfrog-cli&distro=openSUSE Tumbleweed< 2.104.1-1.1
Ubuntu1 product
- golang-github-nwaples-rardecodeAll versions (No fix recorded)
8 vendors · 73 products
References
10 links
- github.com/nwaples/rardecodePACKAGE