Repository navigation
CVE-2025-11579 #1254
Description
Snyk reports a vulnerability CVE-2025-11579 in the jfrog-client-go library, arising from a github.com/nwaples/rardecode dependency.
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNWAPLESRARDECODE-13537507
Why does a REST client need a RAR library at all?
Activity
RemiBou commentedon Oct 29, 2025
It's a medium security issue, from an indirect dependency. We'll evaluate to bump it, in the mean time if you use this library you can also bump the indirect dependency on your project.
Crocmagnon commentedon Dec 8, 2025
Apparently there are no known patched version in the v1 module. A fix is available in github.com/nwaples/rardecode/v2, which we can't update on our own.
https://pkg.go.dev/vuln/GO-2025-4020
saya-entro commentedon Dec 24, 2025
Sent a pr with the fix: #1289
can anyone review it?
MytsYurii commentedon Feb 16, 2026
@jongler @reshmifrog @attiasas, can someone check this request?
We do have an integration with Jfrog, and because of that, it shows the vulnerability in our code :(
saya-entro commentedon Mar 18, 2026
no news, good news(?)
Crocmagnon commentedon Aug 16, 2026
It's been fixed on master but not released AFAICT.