Junglewise Threat Intelligence

CVE-2026-4111: libarchive infinite loop in RAR5 decompression

CVE-2026-4111 · Severity: high · CVSS 7.5 · Published 2026-03-13

Technologies: Libarchive. Vendors: Red Hat, Libarchive.

Executive brief

A flaw was found in libarchive, a widely used software library for reading and writing various compressed file formats. When the library attempts to process a specially crafted RAR5 archive, it can enter an infinite loop that consumes all available processor power. This can be used by attackers to crash or freeze services that automatically scan or process uploaded files, leading to a total service outage.

Technical details

A vulnerability exists in the RAR5 decompression logic of libarchive within the archive_read_data() processing path. The flaw is categorized as CWE-835 (Loop with Unreachable Exit Condition). When a specially crafted RAR5 archive is processed, the internal state machine fails to progress, resulting in an infinite loop that exhausts CPU resources. The attack is particularly effective because the malicious archive can pass initial checksum and structural validations, preventing detection by applications before the decompression routine is invoked. A fix has been identified in libarchive pull request 2877, and Red Hat has issued multiple advisories (e.g., RHSA-2026:10065, RHSA-2026:10081) for affected products.

Affected products

  • libarchive libarchive All versions prior to the fix in pull request 2877
  • Red Hat OpenShift Container Platform 4.16, 4.19
  • Red Hat Update Infrastructure 5.1

Timeline

  • 2026-03-13: disclosed: Initial publication date
  • 2026-03-13: advisory: NVD record created
  • 2026-04-23: patched: Red Hat released security updates for RHUI 5.1
  • 2026-04-29: patched: Red Hat released security updates for OpenShift 4.19.29

References

Related threats