Skip to main content

Red Hat Enterprise Linux 10 CVE-2026-4111

| EUVDEUVD-2026-12031 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-03-13 redhat
Denial Of Service Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat
7.5
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send malformed RAR5 archive
  2. Delivery
    Victim service invokes archive_read_data()
  3. Exploit
    Decompression state machine enters unreachable exit condition
  4. Execution
    Infinite loop consumes CPU core
  5. Impact
    Service becomes unresponsive

Vulnerability Assessment

Weakness
CWE
CWE-835
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires target system to process attacker-supplied RAR5 archives using affected libarchive versions. Specifically: (1) service must invoke libarchive's archive_read_data() function on untrusted RAR5 input, (2) no special configuration or non-default features required-default RAR5 decompression logic is vulnerable, (3) attack succeeds against any libarchive version lacking the PR#2877 fix. Attack vector is network-based (AV:N), attack complexity is low (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N)-services automatically processing archives (antivirus scanners, backup agents, package managers, email attachment handlers) are exploitable without victim action. Limiting factor: impact is availability-only (process-level DoS), not system compromise-attackers cannot gain code execution or privilege escalation. Services processing only archives from authenticated trusted sources or those with strict input validation pipelines face reduced real-world risk despite technical exploitability.
Impact

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates remotely exploitable denial-of-service with no authentication or user interaction required, which normally signals critical priority. However, EPSS 0.04% (11th percentile) suggests extremely low real-world exploitation probability, and CISA KEV absence confirms no known active exploitation. This discrepancy reflects the attack's limited scope: impact is availability-only (A:H/C:N/I:N), exploitation requires victim systems to automatically process untrusted RAR5 archives, and the observable symptom (CPU exhaustion) is typically detectable and recoverable through process monitoring. SSVC decision factors: exploitation status is none detected, automatable (can be mass-scanned via malicious archive distribution), technical impact is partial (single-service DoS, not full system compromise). Priority should be moderate for internet-facing archive processing services (email gateways, web upload handlers) but lower for systems processing only trusted internal archives. The Red Hat reporter designation and multiple RHSA advisories confirm vendor validation. Organizations should prioritize patching based on whether they process untrusted archives from external sources rather than raw CVSS score.
Exploit ScenarioDerived

Attacker crafts a malformed RAR5 archive with specific internal state flags that trigger the infinite loop condition in archive_read_data(). They submit this archive to a target service (e.g., email server with attachment scanning, web application with file upload, package repository mirror). The service's libarchive-based extraction automatically processes the file, entering an infinite loop that pegs one CPU core at 100% utilization. No exploit code publication confirmed, but the structural nature of the bug and availability of GitHub PR#2877 details provides sufficient information for skilled attackers to reproduce.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv4 – Apr 20, 2026

Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).

Earlier versions of this analysis (3)
v3 Apr 17, 2026 - 14:29 cvss changed CVSS 7.5

Infinite loop in libarchive RAR5 decompression allows unauthenticated remote denial-of-service against applications processing untrusted archives. Crafted RAR5 files that pass checksum validation trigger persistent CPU exhaustion in archive_read_data() processing. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. Vendor patches available from Red Hat and Ubuntu. EPSS score of 0.04% (11th percentile) indicates low observed exploitation probability. No public exploit code or CISA KEV listing identified at time of analysis.

v2 Apr 17, 2026 - 12:28 cvss changed CVSS 7.5

Infinite loop in libarchive RAR5 decompression allows remote denial of service via malformed archives. Remote unauthenticated attackers can crash services processing RAR5 archives by submitting crafted files that pass checksum validation but trigger unbounded CPU consumption in archive_read_data(). Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. Vendor patches available (RHSA-2026:5063 and related advisories). EPSS score is low (0.04%, 11th percentile) with no public exploit identified at time of analysis, suggesting limited immediate exploitation risk despite high CVSS 7.5 rating.

v1 Mar 13, 2026 - 16:57 CVSS 7.5

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed

RemediationAI

Apply vendor-supplied patches immediately for systems processing untrusted archives. Red Hat users should install updates via the RHSA advisories listed above using 'yum update libarchive' or 'dnf update libarchive' appropriate to their RHEL version. Ubuntu users should follow guidance in USN-8147-1. Upstream fix is available in libarchive PR#2877 for organizations building from source. If patching cannot be completed immediately, implement compensating controls: (1) disable automated RAR5 archive processing in services handling untrusted input-this breaks functionality for legitimate RAR5 files but eliminates attack surface; (2) implement CPU resource limits (cgroups, ulimit) and monitoring with automatic process termination for archive extraction workers-allows detection and recovery but service remains vulnerable to repeated attacks; (3) reject RAR5 format entirely via MIME type or magic number filtering at upload/email gateway boundaries-preserves functionality for other archive formats but may impact users legitimately sending RAR5 files. Each mitigation trades functionality for security. Long-term solution requires vendor patches from Red Hat, Ubuntu, or upstream libarchive project.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability resides in libarchive, a widely-deployed open-source library for reading and writing streaming archives (tar, zip, RAR, etc.). The flaw (CWE-835: Loop with Unreachable Exit Condition) occurs specifically in the RAR5 format decompression state machine within archive_read_data(). The malicious archive exploits a logic flaw where internal decompression state transitions fail to advance, causing the parser to spin indefinitely while consuming CPU. The attack is particularly insidious because the archive satisfies structural and checksum validation, bypassing pre-processing detection mechanisms. Applications using libarchive for automated archive processing (package managers, backup tools, email gateways, file upload services) are vulnerable when they invoke archive_read_data() on untrusted RAR5 files. The CPE data confirms impact across Red Hat Enterprise Linux 6, 7, 8, 9, 10 and OpenShift Container Platform 4, indicating widespread deployment in enterprise Linux environments.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Updated
Apr 20, 2026 - 04:33 vuln.today
v4 - CVSS changed
Analysis Updated
Apr 17, 2026 - 14:29 vuln.today
v3 - CVSS changed
Analysis Updated
Apr 17, 2026 - 12:28 vuln.today
v2 - CVSS changed
Patch released
Apr 06, 2026 - 12:45 nvd
Patch available
CVE Published
Mar 13, 2026 - 11:45 nvd
HIGH 7.5

DescriptionCVE.org

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

Executive ViewAI

Why It Matters

CVE-2026-4111 is a denial-of-service vulnerability in libarchive's RAR5 decompression affecting Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. Remote attackers can crash archive processing services by submitting specially crafted RAR files, disrupting operations that depend on archive extraction without requiring authentication. While no active exploitation has been confirmed, the broad impact across critical infrastructure platforms warrants timely remediation.

Business Impact: High
Compensating Controls

Apply vendor patch. Until patched: implement input validation to reject malformed RAR5 archives before processing, restrict archive processing services to trusted internal sources only, and deploy rate limiting on archive submission endpoints to reduce denial-of-service impact.

Threat Intelligence Overview

EPSS Score
0.0%
Top 89% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8147-1 ADVISORY https://vuldb.com/?id.350979 REF https://access.redhat.com/errata/RHSA-2026:10065 REF https://access.redhat.com/errata/RHSA-2026:10081 REF https://access.redhat.com/errata/RHSA-2026:10097 REF https://access.redhat.com/errata/RHSA-2026:14773 REF https://access.redhat.com/errata/RHSA-2026:15087 REF https://access.redhat.com/errata/RHSA-2026:16008 REF https://access.redhat.com/errata/RHSA-2026:16009 REF https://access.redhat.com/errata/RHSA-2026:16174 REF https://access.redhat.com/errata/RHSA-2026:17596 REF https://access.redhat.com/errata/RHSA-2026:25096 REF https://access.redhat.com/errata/RHSA-2026:5063 REF https://access.redhat.com/errata/RHSA-2026:5080 REF https://access.redhat.com/errata/RHSA-2026:6647 REF https://access.redhat.com/errata/RHSA-2026:7093 REF https://access.redhat.com/errata/RHSA-2026:7105 REF https://access.redhat.com/errata/RHSA-2026:7106 REF https://access.redhat.com/errata/RHSA-2026:7239 REF https://access.redhat.com/errata/RHSA-2026:7329 REF https://access.redhat.com/errata/RHSA-2026:7335 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:8423 REF https://access.redhat.com/errata/RHSA-2026:8746 REF https://access.redhat.com/errata/RHSA-2026:8747 REF https://access.redhat.com/errata/RHSA-2026:8748 REF https://access.redhat.com/errata/RHSA-2026:8865 REF https://access.redhat.com/errata/RHSA-2026:8944 REF https://access.redhat.com/errata/RHSA-2026:9832 REF https://access.redhat.com/security/cve/CVE-2026-4111 REF https://bugzilla.redhat.com/show_bug.cgi?id=2446453 REF https://github.com/libarchive/libarchive/pull/2877 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4111.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy