CVE-2026-4111

7.5

Red Hat · Red Hat Enterprise Linux (libarchive)

A flaw in the libarchive RAR5 decompression logic allows unauthenticated remote attackers to trigger an infinite loop, resulting in persistent denial-of-service conditions.

Executive summary

A critical vulnerability in the libarchive library within Red Hat Enterprise Linux allows unauthenticated attackers to cause a denial-of-service by consuming system resources through crafted RAR5 archives.

Vulnerability

The vulnerability is an infinite loop (CWE-835) occurring within the archive_read_data processing path. It can be triggered by an unauthenticated attacker providing a specially crafted RAR5 archive that bypasses standard checksum validations, leading to indefinite CPU resource consumption.

Business impact

The exploitation of this flaw can lead to significant service degradation or complete system unavailability, as the affected application will enter an infinite loop upon processing the malicious file. Given the CVSS score of 7.5, this high severity vulnerability poses a direct risk to business continuity, particularly for automated systems that ingest or scan uploaded archives, such as email gateways, file servers, or automated backup solutions.

Remediation

Immediate Action: Update the libarchive package to the versions specified in the relevant Red Hat Security Advisories (RHSA-2026:10065, RHSA-2026:10081, RHSA-2026:10097, RHSA-2026:14773, RHSA-2026:15087, RHSA-2026:16008, RHSA-2026:16009, or RHSA-2026:16174).

Proactive Monitoring: Monitor system CPU utilization trends for unexpected spikes associated with archive processing services, and review application logs for errors or timeouts occurring during file decompression.

Compensating Controls: Implement file size limits and content scanning at the network edge or application entry point to prevent the ingestion of unknown or untrusted RAR5 archives until patching is complete.

Exploitation status

Public Exploit Available: Unknown.

Analyst recommendation

Organizations running Red Hat Enterprise Linux versions 9 or 10 must prioritize the application of the provided security patches. Given the potential for automated exploitation, failure to update could result in widespread denial-of-service across affected infrastructure. Please consult the referenced Red Hat errata to ensure the correct package version is applied for your specific deployment environment.

More Red Hat CVEs

Sources

Originally found and disclosed by Red Hat would like to thank Elhanan Haenel for reporting this issue., per the CVE Program record.