CVE-2026-4111

Estado: Pendiente de análisisAlta (7.5)—
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.
CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 7.5
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.69%
Percentil entre todas las CVEs puntuadas: 51
Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1499.004 Application or System Exploitationimpact90 %
RAR5 malformado expuesto en red sin autenticación (AV:N/PR:N/UI:N) causa bucle infinito en descompresión. Aplicaciones que procesan archivos automáticamente sufren DoS de CPU (CWE-835, infinite loop).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Application Isolation and Sandboxing
Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Libarchive — Libarchive^AI
CWE

CWE-835
CWE-835
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-4111",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-4111",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-13T13:36:13.170394Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.7.7-5.el10_1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.7.7-5.el10_0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.5.3-7.el9_7",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.5.3-7.el9_7",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream",
            "cpe:/o:redhat:rhel_e4s:9.0::baseos"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.5.3-2.el9_0.3",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream",
            "cpe:/o:redhat:rhel_e4s:9.2::baseos"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.5.3-5.el9_2.1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream",
            "cpe:/a:redhat:rhel_eus:9.4::crb",
            "cpe:/o:redhat:rhel_eus:9.4::baseos"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.5.3-4.el9_4.2",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/o:redhat:rhel_eus:9.6::baseos"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.5.3-6.el9_6.1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "versions": [
            {
              "status": "unaffected",
              "version": "413.92.202604080111-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "414.92.202605060243-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "415.92.202605060220-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "versions": [
            {
              "status": "unaffected",
              "version": "416.94.202604211449-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "versions": [
            {
              "status": "unaffected",
              "version": "417.94.202605112123-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "versions": [
            {
              "status": "unaffected",
              "version": "418.94.202604140044-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.19::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.19",
          "versions": [
            {
              "status": "unaffected",
              "version": "4.19.9.6.202604211219-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.2",
          "versions": [
            {
              "status": "unaffected",
              "version": "1780681984",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.2",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775740563",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "1778244559",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "1778244531",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/vllm-rocm-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "1778244546",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/vllm-spyre-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775680192",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775680262",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/vllm-rocm-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775749857",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Discovery 2",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775668717",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "discovery/discovery-server-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Discovery 2",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775675922",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "discovery/discovery-ui-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Hardened Images",
          "versions": [
            {
              "status": "unaffected",
              "version": "3.8.7-1.hum1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive-main",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:insights_proxy:1.5::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Insights proxy 1.5",
          "versions": [
            {
              "status": "unaffected",
              "version": "1776868961",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "insights-proxy/insights-proxy-container-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "versions": [
            {
              "status": "unaffected",
              "version": "1776868774",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhui5/cds-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "versions": [
            {
              "status": "unaffected",
              "version": "1776868744",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhui5/haproxy-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "versions": [
            {
              "status": "unaffected",
              "version": "1776868772",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhui5/installer-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "versions": [
            {
              "status": "unaffected",
              "version": "1776868842",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhui5/rhua-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6",
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "packageName": "openshift/ose-rhel-coreos-8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.7.7-5.el10_1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.7.7-5.el10_0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9",
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.5.3-7.el9_7",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.5.3-2.el9_0.3",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.5.3-5.el9_2.1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.5.3-4.el9_4.2",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.5.3-6.el9_6.1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "versions": [
            {
              "status": "unaffected",
              "version": "413.92.202604080111-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "414.92.202605060243-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "415.92.202605060220-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "versions": [
            {
              "status": "unaffected",
              "version": "416.94.202604211449-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "versions": [
            {
              "status": "unaffected",
              "version": "417.94.202605112123-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "versions": [
            {
              "status": "unaffected",
              "version": "418.94.202604140044-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.19::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.19",
          "versions": [
            {
              "status": "unaffected",
              "version": "4.19.9.6.202604211219-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.2",
          "versions": [
            {
              "status": "unaffected",
              "version": "1780681984",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.2",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775740563",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775749857",
              "lessThan": "*",
              "versionType": "rpm"
            },
            {
              "status": "unaffected",
              "version": "1778244559",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775680262",
              "lessThan": "*",
              "versionType": "rpm"
            },
            {
              "status": "unaffected",
              "version": "1778244531",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/vllm-rocm-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "1778244546",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/vllm-spyre-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AI Inference Server 3.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775680192",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Discovery 2",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775668717",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "discovery/discovery-server-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Discovery 2",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775675922",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "discovery/discovery-ui-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Hardened Images",
          "versions": [
            {
              "status": "unaffected",
              "version": "3.8.7-1.hum1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libarchive-main",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:insights_proxy:1.5::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Insights proxy 1.5",
          "versions": [
            {
              "status": "unaffected",
              "version": "1776868961",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "insights-proxy/insights-proxy-container-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "versions": [
            {
              "status": "unaffected",
              "version": "1776868774",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhui5/cds-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "versions": [
            {
              "status": "unaffected",
              "version": "1776868744",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhui5/haproxy-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "versions": [
            {
              "status": "unaffected",
              "version": "1776868772",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhui5/installer-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "versions": [
            {
              "status": "unaffected",
              "version": "1776868842",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhui5/rhua-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6",
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "packageName": "libarchive",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-13T19:55:13.917",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:10065",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:10081",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:10097",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:14773",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:15087",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:16008",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:16009",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:16174",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:17596",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:25096",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:5063",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:5080",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:6647",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:7093",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:7105",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:7106",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:7239",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:7329",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:7335",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:8423",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:8746",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:8747",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:8748",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:8865",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:8944",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:9832",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-4111",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446453",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/libarchive/libarchive/pull/2877",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:10065",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:10081",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:10097",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:14773",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:15087",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:16008",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:16009",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:16174",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:17596",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:25096",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:5063",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:5080",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:6647",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:7093",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:7105",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:7106",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:7239",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:7329",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:7335",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:8423",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:8746",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:8747",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:8748",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:8865",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:8944",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:9832",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-4111",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446453",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4111.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives."
    },
    {
      "lang": "es",
      "value": "Se identificó una vulnerabilidad en la lógica de descompresión de archivos RAR5 de la biblioteca libarchive, específicamente dentro de la ruta de procesamiento de archive_read_data(). Cuando se procesa un archivo RAR5 especialmente manipulado, la rutina de descompresión puede entrar en un estado en el que la lógica interna impide el avance. Esta condición resulta en un bucle infinito que consume continuamente recursos de CPU. Debido a que el archivo pasa la validación de suma de verificación y parece estructuralmente válido, las aplicaciones afectadas no pueden detectar el problema antes del procesamiento. Esto puede permitir a los atacantes causar condiciones persistentes de denegación de servicio en servicios que procesan archivos automáticamente."
    }
  ],
  "lastModified": "2026-09-01T12:17:40.873",
  "sourceIdentifier": "secalert@redhat.com"
}