AIKIDO-2026-595238
rarfile is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
rarfileTL;DR
The RAR3 archive parser reads an archive-controlled 32-bit size field for legacy old-style sub-blocks and calls fd.read() with that value before the block header CRC is validated. A crafted archive of under one kilobyte can therefore force the process to allocate a multi-gigabyte bytes object purely while the file is being parsed. Every public entry point that opens an archive, such as RarFile, is_rarfile, extractall, read, and testrar, reaches this path and can exhaust available memory. The fix stops eagerly reading the sub-block payload and bounds the size before any allocation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application parses RAR archives from untrusted or externally supplied sources.
Background info
rarfile is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 4.3.0.
How to fix this
Upgrade the rarfile library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant