← CVE Intelligence

CVE-2026-4111

Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive PUBLISHED

Description (CNA)

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Enterprise Linux 10unaffected 0:3.7.7-5.el10_1 before *
Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Supportunaffected 0:3.7.7-5.el10_0 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:3.5.3-7.el9_7 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:3.5.3-7.el9_7 before *
Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsunaffected 0:3.5.3-2.el9_0.3 before *
Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 0:3.5.3-5.el9_2.1 before *
Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Supportunaffected 0:3.5.3-4.el9_4.2 before *
Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Supportunaffected 0:3.5.3-6.el9_6.1 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 413.92.202604080111-0 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 414.92.202605060243-0 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 415.92.202605060220-0 before *
Red Hat / Red Hat OpenShift Container Platform 4.16unaffected 416.94.202604211449-0 before *
Red Hat / Red Hat OpenShift Container Platform 4.17unaffected 417.94.202605112123-0 before *
Red Hat / Red Hat OpenShift Container Platform 4.18unaffected 418.94.202604140044-0 before *
Red Hat / Red Hat OpenShift Container Platform 4.19unaffected 4.19.9.6.202604211219-0 before *
Red Hat / Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459707 before *
Red Hat / Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459711 before *
Red Hat / Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459759 before *
Red Hat / Cert Manager support for Red Hat OpenShift release 1.18unaffected 1789029076 before *
Red Hat / Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791966259 before *
Red Hat / Red Hat AI Inference Server 3.2unaffected 1780681984 before *
Red Hat / Red Hat AI Inference Server 3.2unaffected 1775740563 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1778244559 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1778244531 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1778244546 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1775680192 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1775680262 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1775749857 before *
Red Hat / Red Hat Discovery 2unaffected 1775668717 before *
Red Hat / Red Hat Discovery 2unaffected 1775675922 before *
Red Hat / Red Hat Hardened Imagesunaffected 3.8.7-1.hum1 before *
Red Hat / Red Hat Insights proxy 1.5unaffected 1776868961 before *
Red Hat / Red Hat Update Infrastructure 5unaffected 1776868774 before *
Red Hat / Red Hat Update Infrastructure 5unaffected 1776868744 before *
Red Hat / Red Hat Update Infrastructure 5unaffected 1776868772 before *
Red Hat / Red Hat Update Infrastructure 5unaffected 1776868842 before *
Red Hat / Red Hat Enterprise Linux 6unknown
Red Hat / Red Hat Enterprise Linux 7unaffected
Red Hat / Red Hat Enterprise Linux 8unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected

CWE

CWE-835

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.