CVE-2026-4111 Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.
Problem types: cwe_id: CWE-835
description: Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10.1
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10.0 Extended Update Support
cpes: cpe:/o:redhat:enterprise_linux_eus:10.0
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.0::appstream
cpe:/o:redhat:rhel_e4s:9.0::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/o:redhat:rhel_e4s:9.2::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.4 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/a:redhat:rhel_eus:9.4::crb
cpe:/o:redhat:rhel_eus:9.4::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.6 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/o:redhat:rhel_eus:9.6::baseos
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.13
cpes: cpe:/a:redhat:openshift:4.13::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.14
cpes: cpe:/a:redhat:openshift:4.14::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.15
cpes: cpe:/a:redhat:openshift:4.15::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.16
cpes: cpe:/a:redhat:openshift:4.16::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.17
cpes: cpe:/a:redhat:openshift:4.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.18
cpes: cpe:/a:redhat:openshift:4.18::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.19
cpes: cpe:/a:redhat:openshift:4.19::el9
default_status: affected
vendor: Red Hat
product: Red Hat AI Inference Server 3.2
cpes: cpe:/a:redhat:ai_inference_server:3.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat AI Inference Server 3.3
cpes: cpe:/a:redhat:ai_inference_server:3.3::el9
default_status: affected
vendor: Red Hat
product: Red Hat AI Inference Server 3.3
cpes: cpe:/a:redhat:ai_inference_server:3.3::el9
default_status: affected
vendor: Red Hat
product: Red Hat AI Inference Server 3.3
cpes: cpe:/a:redhat:ai_inference_server:3.3::el9
default_status: affected
vendor: Red Hat
product: Red Hat AI Inference Server 3.3
cpes: cpe:/a:redhat:ai_inference_server:3.3::el9
default_status: affected
vendor: Red Hat
product: Red Hat AI Inference Server 3.3
cpes: cpe:/a:redhat:ai_inference_server:3.3::el9
default_status: affected
vendor: Red Hat
product: Red Hat AI Inference Server 3.3
cpes: cpe:/a:redhat:ai_inference_server:3.3::el9
default_status: affected
vendor: Red Hat
product: Red Hat Discovery 2
cpes: cpe:/a:redhat:discovery:2::el9
default_status: affected
vendor: Red Hat
product: Red Hat Discovery 2
cpes: cpe:/a:redhat:discovery:2::el9
default_status: affected
vendor: Red Hat
product: Red Hat Hardened Images
cpes: cpe:/a:redhat:hummingbird:1
default_status: affected
vendor: Red Hat
product: Red Hat Insights proxy 1.5
cpes: cpe:/a:redhat:insights_proxy:1.5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Update Infrastructure 5
cpes: cpe:/a:redhat:rhui:5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Update Infrastructure 5
cpes: cpe:/a:redhat:rhui:5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Update Infrastructure 5
cpes: cpe:/a:redhat:rhui:5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Update Infrastructure 5
cpes: cpe:/a:redhat:rhui:5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Elhanan Haenel for reporting this issue.
Published: 2026-03-13T11:45:20.653Z