Description
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | — |
| Red Hat | Red Hat AI Inference Server 3.2 | — | — |
| Red Hat | Red Hat AI Inference Server 3.3 | — | — |
| Red Hat | Red Hat Discovery 2 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat Insights proxy 1.5 | — | — |
| Red Hat | Red Hat Update Infrastructure 5 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libarchive | 3.8.6-1 | — |
| Debian 13 | libarchive | 3.7.4-4+deb13u1 | — |
| Debian 12 | libarchive | 3.6.2-1+deb12u4 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | libarchive | 3.7.7-0ubuntu3.1 | — |
| Ubuntu 24.04 LTS | libarchive | 3.7.2-2ubuntu0.6 | — |
| Ubuntu 22.04 LTS | libarchive | 3.6.0-1ubuntu1.6 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libarchive | 3.4.0-2ubuntu1.5+esm1 | — |
| Ubuntu Pro 18.04 LTS | libarchive | 3.2.2-3.1ubuntu0.7+esm2 | — |
| Ubuntu Pro 16.04 LTS | libarchive | 3.1.2-11ubuntu0.16.04.8+esm2 | — |
| Ubuntu Pro 14.04 LTS | libarchive | 3.1.2-7ubuntu2.8+esm4 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | bsdtar +2 | 3.7.7-5.el10_1 | RHSA-2026:5063 |
| RHEL 9 | bsdtar +2 | 3.5.3-7.el9_7 | RHSA-2026:5080 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | bsdtar +2 | 3.7.7-5.el10_0 | RHSA-2026:8865 |
| RHEL 9.6 EUS | bsdtar +2 | 3.5.3-6.el9_6.1 | RHSA-2026:7105 |
| RHEL 9.4 EUS | bsdtar +2 | 3.5.3-4.el9_4.2 | RHSA-2026:7106 |
| RHEL 9.2 E4S | bsdtar +1 | 3.5.3-5.el9_2.1 | RHSA-2026:6647 |
| RHEL 9.0 E4S | bsdtar +1 | 3.5.3-2.el9_0.3 | RHSA-2026:7093 |
| Red Hat Hardened Images 1 | libarchive +1 | 3.8.7-1.hum1 | RHSA-2026:8944 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | bsdtar +2 | 3.7.7-5.el10_1 | ALSA-2026:5063 |
| AlmaLinux 9 | bsdtar +2 | 3.5.3-7.el9_7 | ALSA-2026:5080 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libarchive | 3.7.7-5.el10_1 | RLSA-2026:5063 |
| Rocky Linux 9 | libarchive | 3.5.3-7.el9_7 | RLSA-2026:5080 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libarchive | 3.7.2-150600.3.20.1 | SUSE-SU-2026:2490-1 |
| SLES 15 SP6 | libarchive | 3.7.2-150600.3.20.1 | SUSE-SU-2026:2490-1 |
| SLES 15 SP5 | libarchive | 3.5.1-150400.3.24.1 | SUSE-SU-2026:2599-1 |
| SLES 15 SP4 | libarchive | 3.5.1-150400.3.24.1 | SUSE-SU-2026:2599-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | libarchive | 3.7.2-150600.3.20.1 | SUSE-SU-2026:2490-1 |
| SLES for SAP 15 SP5 | libarchive | 3.5.1-150400.3.24.1 | SUSE-SU-2026:2599-1 |
| SLES for SAP 15 SP4 | libarchive | 3.5.1-150400.3.24.1 | SUSE-SU-2026:2599-1 |
| SLE Micro 6.1 | libarchive | 3.7.4-slfo.1.1_4.1 | SUSE-SU-2026:22248-1 |
| SLE Micro 6.0 | libarchive | 3.6.2-6.1 | SUSE-SU-2026:22241-1 |
| SLE Micro 5.5 | libarchive | 3.5.1-150400.3.24.1 | SUSE-SU-2026:2599-1 |
| SLE Micro 5.4 | libarchive | 3.5.1-150400.3.24.1 | SUSE-SU-2026:2599-1 |
| SLE Micro 5.3 | libarchive | 3.5.1-150400.3.24.1 | SUSE-SU-2026:2599-1 |
| SLE HPC 15 SP5 | libarchive | 3.5.1-150400.3.24.1 | SUSE-SU-2026:2599-1 |
| SLE HPC 15 SP4 | libarchive | 3.5.1-150400.3.24.1 | SUSE-SU-2026:2599-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libarchive | 3.7.7-5 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | bsdtar +2 | 3.7.7-5.el10_1 | ELSA-2026-5063 |
| Oracle Linux 9 | bsdtar +2 | 3.5.3-7.el9_7 | ELSA-2026-5080 |
Advisories 20
- ALSA-2026:5063 Important: libarchive security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:5080 Important: libarchive security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- RHSA-2026:8944 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:8865 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:7106 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:7105 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:7093 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:6647 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:5080 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:5063 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SUSE-SU-2026:22248-1 Security update for libarchive SUSE / openSUSE Security Updates · Jun 26, 2026
- SUSE-SU-2026:22241-1 Security update for libarchive SUSE / openSUSE Security Updates · Jun 26, 2026
- WID-SEC-2026-0785 libarchive: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jun 25, 2026
- SUSE-SU-2026:2599-1 Security update for libarchive SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:2490-1 Security update for libarchive SUSE / openSUSE Security Updates · Jun 24, 2026
- RLSA-2026:5063 Important: libarchive security update Rocky Linux Security Advisories · Mar 27, 2026
- RLSA-2026:5080 Important: libarchive security update Rocky Linux Security Advisories · Mar 26, 2026
- ELSA-2026-5063 Important: libarchive security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Mar 19, 2026
- ELSA-2026-5080 Important: libarchive security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 19, 2026
References
- RHSA-2026:10065 vendor-advisory
- RHSA-2026:10081 vendor-advisory
- RHSA-2026:10097 vendor-advisory
- RHSA-2026:14773 vendor-advisory
- RHSA-2026:15087 vendor-advisory
- RHSA-2026:16008 vendor-advisory
- RHSA-2026:16009 vendor-advisory
- RHSA-2026:16174 vendor-advisory
- RHSA-2026:17596 vendor-advisory
- RHSA-2026:25096 vendor-advisory
- RHSA-2026:5063 vendor-advisory
- RHSA-2026:5080 vendor-advisory
- RHSA-2026:6647 vendor-advisory
- RHSA-2026:7093 vendor-advisory
- RHSA-2026:7105 vendor-advisory
- RHSA-2026:7106 vendor-advisory
- RHSA-2026:7239 vendor-advisory
- RHSA-2026:7329 vendor-advisory
- RHSA-2026:7335 vendor-advisory
- RHSA-2026:82347 vendor-advisory
- RHSA-2026:82354 vendor-advisory
- RHSA-2026:82372 vendor-advisory
- RHSA-2026:82857 vendor-advisory
- RHSA-2026:8423 vendor-advisory
- RHSA-2026:8746 vendor-advisory
- RHSA-2026:8747 vendor-advisory
- RHSA-2026:8748 vendor-advisory
- RHSA-2026:8865 vendor-advisory
- RHSA-2026:8944 vendor-advisory
- RHSA-2026:9832 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-4111 vdb-entry
- RHBZ#2446453 issue-tracking
- https://github.com/libarchive/libarchive/pull/2877