Critical Security Flaw in libarchive and bsdtar: Infinite Loop Denial of Service Vulnerability
Summary
ALSA-2026:5063: Important: libarchive security update. Affects bsdtar versions < 3.7.7-5.el10_1. Fixed in 3.7.7-5.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libarchive is a programming library that enables the creation and reading of various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. This library is essential for handling compressed files and archives, making it a critical component in many software applications.
Vulnerability Detail
The vulnerability identified as CVE-2026-4111 is an Infinite Loop Denial of Service (DoS) issue that occurs during the decompression of RAR5 files via the archive_read_data() function in libarchive. An attacker can exploit this vulnerability by crafting a malicious RAR5 file that, when processed by the affected library, causes the application to enter an infinite loop. This results in resource exhaustion, potentially leading to a denial of service, where legitimate users are unable to access the service or application.
How To Fix
Minimum fixed version
3.7.7-5.el10_1
This is the first release that contains the fix.
sudo dnf update bsdtarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability other than applying the patch. Users are advised to refrain from processing untrusted RAR5 files until the update is applied.
Conclusion
The libarchive security update addresses a critical vulnerability that could lead to denial of service through infinite loops when processing malicious RAR5 files. It is crucial for users to update their packages to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for bsdtar →
FAQ
CVE-2026-4111 is a security vulnerability in the libarchive library that can lead to an Infinite Loop Denial of Service when processing malicious RAR5 files.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By simply uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
The primary impact is a denial of service, where an attacker can cause the application to become unresponsive, affecting all users trying to access the service.
The best prevention method is to update the affected packages to the patched version as soon as it becomes available. Avoid processing untrusted files in the meantime.
For more details, you can refer to the CVE page associated with CVE-2026-4111, which provides in-depth information about the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for bsdtar.
