Critical Security Update for libarchive: Addressing Vulnerabilities in Multiple Packages
Summary
RHSA-2026:69553: Red Hat Security Advisory: libarchive security update. Affects bsdcat-debuginfo versions < 0:3.7.7-11.el10_2. Fixed in 0:3.7.7-11.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a widely used library that provides a flexible and efficient way to read and write various archive formats, including tar, zip, and cpio. It is essential for applications that require file compression and decompression functionalities. The recent vulnerabilities identified in libarchive and its associated packages, such as bsdcat, bsdcpio, and bsdtar, pose significant risks to systems relying on these tools, potentially leading to unauthorized access or data corruption.
Vulnerability Detail
The vulnerabilities, identified as CVE-2026-15028 and CVE-2026-16517, stem from flaws in the libarchive library that could allow attackers to exploit the library's handling of archive files. This could lead to arbitrary code execution or denial of service, impacting the integrity and availability of affected systems. The vulnerabilities are particularly concerning due to the widespread use of libarchive in various applications and services, making it a prime target for exploitation.
How To Fix
Minimum fixed version
0:3.7.7-11.el10_2
This is the first release that contains the fix.
sudo dnf update bsdcat-debuginfoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected functionalities of the libarchive library until the packages are updated. Additionally, restricting access to the affected applications may mitigate the risk of exploitation.
Conclusion
The vulnerabilities in libarchive and its associated packages pose significant risks to systems that rely on these tools. It is essential to update to the patched versions to mitigate these risks. Users should also consider using Vulert to monitor for vulnerabilities in their applications and ensure they remain secure.
See every vulnerability recorded for bsdcat-debuginfo →
FAQ
The vulnerabilities are identified as CVE-2026-15028 and CVE-2026-16517, which could lead to arbitrary code execution or denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of the vulnerability is 3.9, indicating a moderate level of risk.
If immediate updates are not possible, consider restricting access to the affected applications and avoiding the use of vulnerable functionalities.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:69553.json.
Related vulnerabilities
Recent vulnerabilities recorded for bsdcat-debuginfo.
