CVE-2026-4111Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive

Description

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

Timeline

Scores

EPSS (exploitation in 30 days)

0.77% · top 44% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Affected products

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:3.7.7-5.el10_1 – < *

• Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support

  • unaffected 0:3.7.7-5.el10_0 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:3.5.3-7.el9_7 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:3.5.3-7.el9_7 – < *

• Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

  • unaffected 0:3.5.3-2.el9_0.3 – < *

• Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

  • unaffected 0:3.5.3-5.el9_2.1 – < *

• Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Support

  • unaffected 0:3.5.3-4.el9_4.2 – < *

• Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support

  • unaffected 0:3.5.3-6.el9_6.1 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.13

  • unaffected 413.92.202604080111-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.14

  • unaffected 414.92.202605060243-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.15

  • unaffected 415.92.202605060220-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.16

  • unaffected 416.94.202604211449-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.17

  • unaffected 417.94.202605112123-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.18

  • unaffected 418.94.202604140044-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.19

  • unaffected 4.19.9.6.202604211219-0 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.18

  • unaffected 1791459707 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.18

  • unaffected 1791459711 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.18

  • unaffected 1791459759 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.18

  • unaffected 1789029076 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.18

  • unaffected 1791966259 – < *

• Red Hat · Red Hat AI Inference Server 3.2

  • unaffected 1780681984 – < *

• Red Hat · Red Hat AI Inference Server 3.2

  • unaffected 1775740563 – < *

• Red Hat · Red Hat AI Inference Server 3.3

  • unaffected 1778244559 – < *

• Red Hat · Red Hat AI Inference Server 3.3

  • unaffected 1778244531 – < *

• Red Hat · Red Hat AI Inference Server 3.3

  • unaffected 1778244546 – < *

• Red Hat · Red Hat AI Inference Server 3.3

  • unaffected 1775680192 – < *

• Red Hat · Red Hat AI Inference Server 3.3

  • unaffected 1775680262 – < *

• Red Hat · Red Hat AI Inference Server 3.3

  • unaffected 1775749857 – < *

• Red Hat · Red Hat Discovery 2

  • unaffected 1775668717 – < *

• Red Hat · Red Hat Discovery 2

  • unaffected 1775675922 – < *

• Red Hat · Red Hat Hardened Images

  • unaffected 3.8.7-1.hum1 – < *

• Red Hat · Red Hat Insights proxy 1.5

  • unaffected 1776868961 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1776868774 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1776868744 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1776868772 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1776868842 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unknown

• Red Hat · Red Hat Enterprise Linux 7

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 8

  All versions: unaffected

• Red Hat · Red Hat OpenShift Container Platform 4

  All versions: unaffected

What to do

Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-12031 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-4111](https://cveledger.app/badge/CVE-2026-4111.svg)](https://cveledger.app/cve/CVE-2026-4111)

Record last updated 4 Nov 2026, 22:44 UTC.