CVE-2026-97370

High

Advisory

Published 15 Oct 2026In the index since 16 Oct 2026

Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

Carried by container images the latest versions of 3 of 18,137 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
junrarmaven	3.0.1-Ubooquity, 4.0.0	7.6.1	2

3 by stars

Chart

Latest

Affected images

Radar Score

airsonicgeek-cookbook

1 of the 1 container images this version deploys carry CVE-2026-97370.

Container image	Digest	Package	Fixed in
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	junrar@4.0.0	7.6.1

19,050

1 of the 1 container images this version deploys carry CVE-2026-97370.

Container image	Digest	Package	Fixed in
linuxserver/ubooquity :2.1.2-ls36	9932d6759112	junrar@3.0.1-Ubooquity	7.6.1

4,355

1 of the 1 container images this version deploys carry CVE-2026-97370.

Container image	Digest	Package	Fixed in
linuxserver/ubooquity :2.1.2-ls36	9932d6759112	junrar@3.0.1-Ubooquity	7.6.1

4,355

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
linuxserver/ubooquity :2.1.2-ls36	9932d6759112	junrar@3.0.1-Ubooquity	7.6.1	2
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	junrar@4.0.0	7.6.1	1