Critical Denial of Service Vulnerability in libarchive: CVE-2026-4111
Summary
RLSA-2026:5063: Important: libarchive security update. Affects libarchive versions < 0:3.7.7-5.el10_1. Fixed in 0:3.7.7-5.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a versatile programming library that enables the creation and reading of various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in tools like bsdtar, scripting language bindings such as python-libarchive, and numerous popular desktop file managers. The library's extensive use makes it a critical component in many software applications, and vulnerabilities within it can have widespread implications.
Vulnerability Detail
The vulnerability identified as CVE-2026-4111 in libarchive is an Infinite Loop Denial of Service (DoS) issue that arises during the decompression of RAR5 archives via the archive_read_data() function. This flaw can lead to an application becoming unresponsive, potentially causing service disruptions. The vulnerability is particularly concerning due to its ability to be exploited without authentication, making it accessible to any user who can interact with the affected application.
How To Fix
Minimum fixed version
0:3.7.7-5.el10_1
This is the first release that contains the fix.
sudo dnf update libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing RAR5 archives until the update is applied. This will help prevent potential exploitation of the vulnerability while a permanent fix is being implemented.
Conclusion
The libarchive library's vulnerability, CVE-2026-4111, poses a significant risk of Denial of Service through infinite loops during RAR5 decompression. It is crucial for users to update to the patched version to safeguard their applications. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for libarchive →
FAQ
CVE-2026-4111 is a vulnerability in the libarchive library that can cause an Infinite Loop Denial of Service during RAR5 decompression.
If your application uses libarchive and processes RAR5 archives, it may become unresponsive, leading to service disruptions.
Yes, a patch is available in the form of an updated libarchive package version 0:3.7.7-5.el10_1.
As a workaround, avoid processing RAR5 archives until you can apply the update to mitigate the risk of exploitation.
You can use Vulert's playground at Vulert Scanner to monitor and check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
