Critical Security Update for libarchive: Infinite Loop Denial of Service Vulnerability
Summary
ALSA-2026:5080: Important: libarchive security update. Affects bsdtar versions < 3.5.3-7.el9_7. Fixed in 3.5.3-7.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libarchive is a programming library that facilitates the creation and reading of various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in tools such as bsdtar, scripting language bindings like python-libarchive, and numerous popular desktop file managers. This library's versatility makes it a critical component in many software applications, but it also exposes users to potential security risks if not properly maintained.
Vulnerability Detail
The vulnerability identified as CVE-2026-4111 in libarchive allows for an infinite loop denial of service during the decompression of RAR5 files via the archive_read_data() function. This issue arises from improper handling of certain inputs, which can lead to excessive resource consumption, potentially rendering the application unresponsive. Attackers can exploit this vulnerability by crafting malicious RAR5 files, leading to service interruptions and degraded performance for users.
How To Fix
Minimum fixed version
3.5.3-7.el9_7
This is the first release that contains the fix.
sudo dnf update bsdtarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted RAR5 files until the update is applied. This precaution will help mitigate the risk of denial of service attacks while a permanent fix is being implemented.
Conclusion
The libarchive library is an essential tool for handling various archive formats, but it is crucial to address the identified vulnerability (CVE-2026-4111) to maintain system integrity and availability. By updating to the latest version, users can protect their applications from potential denial of service attacks.
See every vulnerability recorded for bsdtar →
FAQ
CVE-2026-4111 is a vulnerability in the libarchive library that can lead to an infinite loop denial of service during the decompression of RAR5 files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact is a denial of service, where the application may become unresponsive due to excessive resource consumption when processing malicious RAR5 files.
Yes, a patch is available in version 3.5.3-7.el9_7 or later for the affected packages. Updating to this version will resolve the issue.
If you cannot update immediately, avoid processing untrusted RAR5 files to minimize the risk of exploitation until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for bsdtar.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
