Skip to content
Fencer Vulns
high 7.5

CVE-2026-4111 json

Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive

published 2026-03-13 7 mo ago modified 2026-11-04 4 d ago also EUVD-2026-12031

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:3.7.7-5.el10_1
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.7.7-5.el10_0
  • Red Hat Red Hat Enterprise Linux 9 0:3.5.3-7.el9_7
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:3.5.3-2.el9_0.3
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:3.5.3-5.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:3.5.3-4.el9_4.2
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:3.5.3-6.el9_6.1
  • Red Hat Red Hat OpenShift Container Platform 4.13 413.92.202604080111-0
  • Red Hat Red Hat OpenShift Container Platform 4.14 414.92.202605060243-0
  • Red Hat Red Hat OpenShift Container Platform 4.15 415.92.202605060220-0
  • Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202604211449-0
  • Red Hat Red Hat OpenShift Container Platform 4.17 417.94.202605112123-0
  • Red Hat Red Hat OpenShift Container Platform 4.18 418.94.202604140044-0
  • Red Hat Red Hat OpenShift Container Platform 4.19 4.19.9.6.202604211219-0
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 1789029076, 1791459707, 1791459711, 1791459759, 1791966259
  • Red Hat Red Hat AI Inference Server 3.2 1775740563, 1780681984
  • Red Hat Red Hat AI Inference Server 3.3 1775680192, 1775680262, 1775749857, 1778244531, 1778244546, 1778244559
  • Red Hat Red Hat Discovery 2 1775668717, 1775675922
  • Red Hat Red Hat Hardened Images 3.8.7-1.hum1
  • Red Hat Red Hat Insights proxy 1.5 1776868961
  • Red Hat Red Hat Update Infrastructure 5 1776868744, 1776868772, 1776868774, 1776868842
  • libarchive Debian 12 3.6.2-1+deb12u4
  • libarchive Debian 13 3.7.4-4+deb13u1
  • libarchive Debian 14 3.8.6-1

debian advisories DEBIAN-CVE-2026-4111

  • libarchive Ubuntu 22.04 LTS 3.6.0-1ubuntu1.6
  • libarchive Ubuntu 24.04 LTS 3.7.2-2ubuntu0.6
  • libarchive Ubuntu 25.10 3.7.7-0ubuntu3.1
  • libarchive Ubuntu Pro 14.04 LTS 3.1.2-7ubuntu2.8+esm4
  • libarchive Ubuntu Pro 16.04 LTS 3.1.2-11ubuntu0.16.04.8+esm2
  • libarchive Ubuntu Pro 18.04 LTS 3.2.2-3.1ubuntu0.7+esm2
  • libarchive Ubuntu Pro 20.04 LTS 3.4.0-2ubuntu1.5+esm1

ubuntu advisories UBUNTU-CVE-2026-4111

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libarchive hummingbird 1 3.8.7-1.hum1
  • libarchive RHEL 10.1 3.7.7-5.el10_1
  • bsdtar RHEL 10.1 3.7.7-5.el10_1
  • libarchive RHEL 9 3.5.3-7.el9_7
  • bsdtar RHEL 9 3.5.3-7.el9_7
  • libarchive enterprise linux eus 10.0 3.7.7-5.el10_0
  • bsdtar enterprise linux eus 10.0 3.7.7-5.el10_0
  • libarchive RHEL 9.6 EUS 3.5.3-6.el9_6.1

red hat advisories RHSA-2026:8944RHSA-2026:8865RHSA-2026:7105RHSA-2026:7106RHSA-2026:7093RHSA-2026:5063

  • libarchive SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 3.5.1-150400.3.24.1
  • libarchive SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 +1 more 3.7.2-150600.3.20.1
  • libarchive Linux Micro 6.1 3.7.4-slfo.1.1_4.1
  • libarchive Linux Micro 6.0 3.6.2-6.1

suse advisories SUSE-SU-2026:2599-1SUSE-SU-2026:2490-1SUSE-SU-2026:22248-1SUSE-SU-2026:22241-1

  • libarchive AlmaLinux 10 3.7.7-5.el10_1
  • bsdtar AlmaLinux 10 3.7.7-5.el10_1
  • libarchive AlmaLinux 9 3.5.3-7.el9_7
  • bsdtar AlmaLinux 9 3.5.3-7.el9_7

almalinux advisories ALSA-2026:5063ALSA-2026:5080

  • libarchive Rocky Linux 10 3.7.7-5.el10_1
  • libarchive Rocky Linux 9 3.5.3-7.el9_7

rocky linux advisories RLSA-2026:5063RLSA-2026:5080

  • libarchive Azure Linux 3.0 3.7.7-5

azure linux advisories AZL-79886

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-4111 updated cvss 7.5

libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive

  • Red Hat Enterprise Linux 6 libarchive
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat AI Inference Server 3.2 rhaiis 1775740563, rhaiis/model-opt-cuda-rhel9 1780681984
    fixed: vendor fix RHSA-2026:25096
  • Red Hat AI Inference Server 3.3 rhaiis 1775680192, rhaiis 1775680262, rhaiis 1775749857, rhaiis 1778244531, rhaiis 1778244546, rhaiis 1778244559
    fixed: vendor fix RHSA-2026:16008
  • Red Hat CodeReady Linux Builder EUS (v.9.4) bsdcat-debuginfo 3.5.3-4.el9_4.2, bsdtar-debuginfo 3.5.3-4.el9_4.2, libarchive-devel 3.5.3-4.el9_4.2, bsdcpio-debuginfo 3.5.3-4.el9_4.2, libarchive-debuginfo 3.5.3-4.el9_4.2, libarchive-debugsource 3.5.3-4.el9_4.2
    fixed: vendor fix RHSA-2026:7106
  • Red Hat Discovery 2 discovery 1775668717, discovery 1775675922
    fixed: vendor fix RHSA-2026:7329
  • Red Hat Enterprise Linux AppStream (v. 9) bsdtar 3.5.3-7.el9_7
    fixed: vendor fix RHSA-2026:5080
  • Red Hat Enterprise Linux AppStream (v. 10) bsdtar 3.7.7-5.el10_1
    fixed: vendor fix RHSA-2026:5063
show 25 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) bsdtar 3.5.3-2.el9_0.3
    fixed: vendor fix RHSA-2026:7093
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) bsdtar 3.5.3-5.el9_2.1
    fixed: vendor fix RHSA-2026:6647
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) bsdtar 3.7.7-5.el10_0
    fixed: vendor fix RHSA-2026:8865
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) bsdtar 3.5.3-4.el9_4.2
    fixed: vendor fix RHSA-2026:7106
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) bsdtar 3.5.3-6.el9_6.1
    fixed: vendor fix RHSA-2026:7105
  • Red Hat Enterprise Linux BaseOS (v. 9) libarchive 3.5.3-7.el9_7
    fixed: vendor fix RHSA-2026:5080
  • Red Hat Enterprise Linux BaseOS (v. 10) libarchive 3.7.7-5.el10_1
    fixed: vendor fix RHSA-2026:5063
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) libarchive 3.5.3-2.el9_0.3
    fixed: vendor fix RHSA-2026:7093
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libarchive 3.5.3-5.el9_2.1
    fixed: vendor fix RHSA-2026:6647
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libarchive 3.7.7-5.el10_0
    fixed: vendor fix RHSA-2026:8865
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libarchive 3.5.3-4.el9_4.2
    fixed: vendor fix RHSA-2026:7106
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libarchive 3.5.3-6.el9_6.1
    fixed: vendor fix RHSA-2026:7105
  • Red Hat Hardened Images libarchive 3.8.7-1.hum1
    fixed: vendor fix RHSA-2026:8944
  • Red Hat Insights proxy 1.5 insights-proxy 1776868961
    fixed: vendor fix RHSA-2026:9832
  • Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202604080111
    fixed: vendor fix RHSA-2026:7239
  • Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202605060243
    fixed: vendor fix RHSA-2026:15087
  • Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202605060220
    fixed: vendor fix RHSA-2026:14773
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202604211449
    fixed: vendor fix RHSA-2026:10097
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202605112123
    fixed: vendor fix RHSA-2026:17596
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202604140044
    fixed: vendor fix RHSA-2026:8423
  • Red Hat OpenShift Container Platform 4.19 rhcos 4.19.9.6.202604211219
    fixed: vendor fix RHSA-2026:10081
  • Red Hat Update Infrastructure 5 rhui5 1776868744, rhui5 1776868772, rhui5 1776868774, rhui5 1776868842
    fixed: vendor fix RHSA-2026:10065
  • Red Hat Enterprise Linux 7 bsdtar, bsdcpio, libarchive
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 8 bsdtar, libarchive
    not affected: component not present
  • Red Hat Hardened Images bsdcat 3.8.7-1.hum1, bsdtar 3.8.7-1.hum1, bsdcpio 3.8.7-1.hum1, bsdunzip 3.8.7-1.hum1 Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18
  • Red Hat Red Hat AI Inference Server 3.2
  • Red Hat Red Hat AI Inference Server 3.3
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Insights proxy 1.5
  • Red Hat Red Hat Update Infrastructure 5
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.