ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-4111

Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive

Published Mar 13, 2026 · catalog updated Oct 14, 2026 · Red Hat Red Hat Enterprise Linux 10

Check if you run it

No confirmed exploitation is on record for CVE-2026-4111. EPSS is 0.70%. Act only if a listed version of Red Hat Red Hat Enterprise Linux 10 is installed.

Gaps on this record

  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.70%
Remediation
Advisory link
Affected products
vendor Red Hat Red Hat Enterprise Linux 10 · vendor Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support · vendor Red Hat Red Hat Enterprise Linux 9 · vendor Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions · vendor Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions · vendor Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor Red Hat Red Hat Enterprise Linux 10version unspecified
  • vendor Red Hat Red Hat Enterprise Linux 10.0 Extended Update Supportversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 9version unspecified
  • vendor Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 9.4 Extended Update Supportversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 9.6 Extended Update Supportversion unspecified

How to fix CVE-2026-4111

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-4111. EPSS is 0.70%. Act only if a listed version of Red Hat Red Hat Enterprise Linux 10 is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-835: Infinite Loop. EPSS 0.70%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 13, 2026 · Catalog

    Detected

    A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive p

  2. Oct 14, 2026 · Catalog

    Updated

    A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive p

  3. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive p

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2026-4111

    A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forw

    vulnerability.circl.lu
  • CSAF AdvisoriesVendor advisoryRHSA-2026:9832:CVE-2026-4111

    A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forw

    security.access.redhat.com
  • CVE.orgVulnerability recordCVE-2026-4111

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-4111

    30-day exploitation probability 0.7%

    first.org
  • NIST NVDVulnerability recordCVE-2026-4111

    A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forw

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.