CVE record · CVE-2026-4111

Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive

CVSS 7.5 HighEPSS 0.0072 · 54th percentile

Published by the CVE Program (CNA: redhat) at 13 Mar 2026, 11:45 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10 Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.7.7-5.el10_1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.7.7-5.el10_0 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.5.3-7.el9_7 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.5.3-7.el9_7 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.5.3-2.el9_0.3 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.5.3-5.el9_2.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.5.3-4.el9_4.2 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.5.3-6.el9_6.1 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.13 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 413.92.202604080111-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.14 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 414.92.202605060243-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.15 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 415.92.202605060220-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.16 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 416.94.202604211449-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.17 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 417.94.202605112123-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 418.94.202604140044-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.19 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 4.19.9.6.202604211219-0 to before * rpm Other versions: affected
Red Hat	Cert Manager support for Red Hat OpenShift release 1.18 Package name: cert-manager/jetstack-cert-manager-acmesolver-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1791459707 to before * rpm Other versions: affected
Red Hat	Cert Manager support for Red Hat OpenShift release 1.18 Package name: cert-manager/jetstack-cert-manager-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1791459711 to before * rpm Other versions: affected
Red Hat	Cert Manager support for Red Hat OpenShift release 1.18 Package name: cert-manager/cert-manager-istio-csr-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1791459759 to before * rpm Other versions: affected
Red Hat	Cert Manager support for Red Hat OpenShift release 1.18 Package name: cert-manager/cert-manager-operator-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789029076 to before * rpm Other versions: affected
Red Hat	Cert Manager support for Red Hat OpenShift release 1.18 Package name: cert-manager/cert-manager-operator-bundle https://catalog.redhat.com/software/containers/	unaffected 1791966259 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.2 Package name: rhaiis/model-opt-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1780681984 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.2 Package name: rhaiis/vllm-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1775740563 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.3 Package name: rhaiis/model-opt-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1778244559 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.3 Package name: rhaiis/vllm-rocm-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1778244531 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.3 Package name: rhaiis/vllm-spyre-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1778244546 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.3 Package name: rhaiis/vllm-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1775680192 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.3 Package name: rhaiis/vllm-rocm-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1775680262 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.3 Package name: rhaiis/model-opt-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1775749857 to before * rpm Other versions: affected
Red Hat	Red Hat Discovery 2 Package name: discovery/discovery-server-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1775668717 to before * rpm Other versions: affected
Red Hat	Red Hat Discovery 2 Package name: discovery/discovery-ui-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1775675922 to before * rpm Other versions: affected
Red Hat	Red Hat Hardened Images Package name: libarchive-main https://catalog.redhat.com/software/containers/	unaffected 3.8.7-1.hum1 to before * rpm Other versions: affected
Red Hat	Red Hat Insights proxy 1.5 Package name: insights-proxy/insights-proxy-container-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1776868961 to before * rpm Other versions: affected
Red Hat	Red Hat Update Infrastructure 5 Package name: rhui5/cds-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1776868774 to before * rpm Other versions: affected
Red Hat	Red Hat Update Infrastructure 5 Package name: rhui5/haproxy-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1776868744 to before * rpm Other versions: affected
Red Hat	Red Hat Update Infrastructure 5 Package name: rhui5/installer-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1776868772 to before * rpm Other versions: affected
Red Hat	Red Hat Update Infrastructure 5 Package name: rhui5/rhua-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1776868842 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 6 Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unknown
Red Hat	Red Hat Enterprise Linux 7 Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unaffected
Red Hat	Red Hat Enterprise Linux 8 Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unaffected
Red Hat	Red Hat OpenShift Container Platform 4 Package name: openshift/ose-rhel-coreos-8 https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unaffected

Identifiers: CVE-2026-4111
CNA: redhat
Weakness (CWE): CWE-835
Tags: Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat Enterprise Linux 9.4 Extended Update Support
Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat OpenShift Container Platform 4.13
Denial of service
Published: 13 Mar 2026
Updated: 4 Nov 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.5	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CNA (redhat)Used for this record
7.5	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	ADP (redhat-SADP)

CISA KEV Not listed.
EPSS 0.0072, the 54th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

13 Mar 2026, 11:45 UTC Confirmed by the CVE List
13 Mar 2026, 19:55 UTC Confirmed by NVD

Sources

References from the CNA

access.redhat.com/errata/RHSA-2026:10065 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:10081 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:10097 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:14773 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:15087 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:16008 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:16009 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:16174 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:17596 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:25096 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:5063 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:5080 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:6647 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:7093 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:7105 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:7106 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:7239 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:7329 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:7335 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:82347 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:82354 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:82372 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:82857 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:8423 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:8746 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:8747 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:8748 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:8865 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:8944 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:9832 vendor-advisoryredhat

And 3 more on the CVE record.

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.