Description
libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libarchive | 3.2.0-2 | — |
| Debian 13 | libarchive | 3.2.0-2 | — |
| Debian 12 | libarchive | 3.2.0-2 | — |
| Debian 8 | libarchive | 3.1.2-11+deb8u3 | DSA-3677-1 |
| Debian 7 | libarchive | 3.0.4-3+wheezy3 | DLA-617-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | libarchive | 3.1.2-11ubuntu0.16.04.3 | USN-3225-1 |
| Ubuntu 14.04 LTS | libarchive | 3.1.2-7ubuntu2.4 | USN-3225-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | bsdtar +3 | 3.1.2-10.el7_2 | RHSA-2016:1844 |
| RHEL 6 | libarchive +1 | 2.8.3-7.el6_8 | RHSA-2016:1850 |
Advisories 5
- RHSA-2016:1850 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2016:1844 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- USN-3225-1 libarchive vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-617-1 libarchive - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3677-1 libarchive - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2016:1844 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- [oss-security] 20160908 Re: CVE request: libarchive (pre 3.2.0) denial of service with gzip quine mailing-list
- https://github.com/libarchive/libarchive/commit/6e06b1c89dd0d16f74894eac4cfc1327a06ee4a0
- https://github.com/libarchive/libarchive/issues/660
- https://bugzilla.redhat.com/show_bug.cgi?id=1347086
- RHSA-2016:1850 vendor-advisory
- [oss-security] 20160908 CVE request: libarchive (pre 3.2.0) denial of service with gzip quine mailing-list
- GLSA-201701-03 vendor-advisory
- https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207362
- 92901 vdb-entry