CVE-2026-4111 Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive
Attackers can cause persistent denial of service in applications using Libarchive by submitting crafted RAR5 archives that trigger an infinite loop during decompression.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4111?
CVE-2026-4111 is a high-severity denial of service vulnerability in Cert Manager support for Red Hat OpenShift release 1.18, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.
Weakness: CWE-835
Which versions are affected by CVE-2026-4111?
Linux distribution packages (40)
bsdtar AlmaLinux:10 | All versions | 3.7.7-5.el10_1 |
libarchive AlmaLinux:10 | All versions | 3.7.7-5.el10_1 |
libarchive-devel AlmaLinux:10 | All versions | 3.7.7-5.el10_1 |
bsdtar AlmaLinux:9 | All versions | 3.5.3-7.el9_7 |
libarchive AlmaLinux:9 | All versions | 3.5.3-7.el9_7 |
libarchive-devel AlmaLinux:9 | All versions | 3.5.3-7.el9_7 |
bsdcat-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.7.7-5.el10_1 |
bsdcpio-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.7.7-5.el10_1 |
bsdtar Red Hat:enterprise_linux:10.1 | All versions | 0:3.7.7-5.el10_1 |
bsdtar-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.7.7-5.el10_1 |
bsdunzip-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.7.7-5.el10_1 |
libarchive Red Hat:enterprise_linux:10.1 | All versions | 0:3.7.7-5.el10_1 |
libarchive-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.7.7-5.el10_1 |
libarchive-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:3.7.7-5.el10_1 |
libarchive-devel Red Hat:enterprise_linux:10.1 | All versions | 0:3.7.7-5.el10_1 |
bsdcat-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.5.3-7.el9_7 |
bsdcpio-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.5.3-7.el9_7 |
bsdtar Red Hat:enterprise_linux:9::appstream | All versions | 0:3.5.3-7.el9_7 |
bsdtar-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.5.3-7.el9_7 |
libarchive-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.5.3-7.el9_7 |
libarchive-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:3.5.3-7.el9_7 |
libarchive-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:3.5.3-7.el9_7 |
bsdcat-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.5.3-7.el9_7 |
bsdcpio-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.5.3-7.el9_7 |
bsdtar-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.5.3-7.el9_7 |
libarchive Red Hat:enterprise_linux:9::baseos | All versions | 0:3.5.3-7.el9_7 |
libarchive-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.5.3-7.el9_7 |
libarchive-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:3.5.3-7.el9_7 |
bsdcat-debuginfo Red Hat:rhel_e4s:9.0::appstream | All versions | 0:3.5.3-2.el9_0.3 |
bsdcpio-debuginfo Red Hat:rhel_e4s:9.0::appstream | All versions | 0:3.5.3-2.el9_0.3 |
bsdtar Red Hat:rhel_e4s:9.0::appstream | All versions | 0:3.5.3-2.el9_0.3 |
bsdtar-debuginfo Red Hat:rhel_e4s:9.0::appstream | All versions | 0:3.5.3-2.el9_0.3 |
libarchive-debuginfo Red Hat:rhel_e4s:9.0::appstream | All versions | 0:3.5.3-2.el9_0.3 |
libarchive-debugsource Red Hat:rhel_e4s:9.0::appstream | All versions | 0:3.5.3-2.el9_0.3 |
bsdcat-debuginfo Red Hat:rhel_e4s:9.0::baseos | All versions | 0:3.5.3-2.el9_0.3 |
bsdcpio-debuginfo Red Hat:rhel_e4s:9.0::baseos | All versions | 0:3.5.3-2.el9_0.3 |
bsdtar-debuginfo Red Hat:rhel_e4s:9.0::baseos | All versions | 0:3.5.3-2.el9_0.3 |
libarchive Red Hat:rhel_e4s:9.0::baseos | All versions | 0:3.5.3-2.el9_0.3 |
libarchive-debuginfo Red Hat:rhel_e4s:9.0::baseos | All versions | 0:3.5.3-2.el9_0.3 |
libarchive-debugsource Red Hat:rhel_e4s:9.0::baseos | All versions | 0:3.5.3-2.el9_0.3 |
How do I fix CVE-2026-4111?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-4111 being exploited?
There is no known exploitation of CVE-2026-4111 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:5063, ALSA-2026:5080, AZL-79886, BELL-CVE-2026-4111, CLSA-2026-1774375084, CLSA-2026-1774375835 and 13 more.