{"action":"Upgrade com.github.junrar:junrar to 7.6.1 or later.","affected":[{"fixed":"7.6.1","introduced":"0"}],"component":"com.github.junrar:junrar","cve_ids":["CVE-2026-97370"],"ecosystem":"Maven","epss":0.00402,"exploited":false,"fixed_versions":["7.6.1"],"ghsa_id":"GHSA-h9h9-2rmf-rvhp","id":"tcs_01M5N907AEXGTSWBHNW2BB67V6","modified_at":"2026-10-15T20:30:07.173215533Z","published_at":"2026-10-15T20:09:47Z","references":["https://osv.dev/vulnerability/GHSA-h9h9-2rmf-rvhp","https://github.com/junrar/junrar/security/advisories/GHSA-h9h9-2rmf-rvhp","https://github.com/junrar/junrar/commit/687a09c42f46066447faa9179ee11314ad6d9afb","https://github.com/junrar/junrar","https://github.com/junrar/junrar/releases/tag/v7.6.1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-h9h9-2rmf-rvhp","url":"https://osv.dev/vulnerability/GHSA-h9h9-2rmf-rvhp"}],"summary":"Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction"}