CVE-2026-4111: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-4111 is an infinite loop denial-of-service vulnerability in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine enters a logical deadlock state that causes it to spin indefinitely, consuming 100% CPU. The vulnerability was reported by researcher Elhanan Haenel, disclosed on March 13, 2026, and affects libarchive versions prior to the fix merged on March 10, 2026. Affected downstream products include Red Hat Enterprise Linux 9 and 10, Red Hat OpenShift Container Platform (4.13–4.19), IBM App Connect Enterprise, IBM MQ container images, Microsoft Azure Linux (AZL3 libarchive 3.7.7-4, CBL-Mariner 2 libarchive 3.6.1-8), and Splunk AppDynamics Cluster Agent. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Bugzilla, Feedly, Microsoft MSRC).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition). The flaw exists in archive_read_support_format_rar5.c within the uncompress_file() routine, arising from a logical deadlock between two independent mechanisms: the half-window output limiter in do_uncompress_block() (which caps decoded output at half the decompression window size, e.g., 65,536 bytes for a 128 KB window) and the filter activation logic in apply_filters() (which requires write_ptr to reach block_start + block_length before passing data to the consumer). When a RAR5 archive contains a filter block with a block_length greater than half the window size (e.g., 70,000 bytes vs. a 65,536-byte limit), the decompressor decodes up to the half-window limit, but the filter never fires because the threshold is not reached; on the next iteration, the half-window limit is immediately hit again with zero new bytes decoded, causing ARCHIVE_RETRY to be returned indefinitely. The existing sanity check in parse_filter() only rejects block_length values above 4 MB, which does not account for the relationship between block_length and window_size, allowing values like 70,000 to pass validation while still triggering the deadlock. The archive also passes all CRC and checksum validation, making pre-processing detection impossible (GitHub PR #2877, Red Hat Bugzilla).

Successful exploitation results in a persistent denial-of-service condition: the affected process consumes 100% of a CPU core indefinitely, exhausting worker threads or processing pipelines in any application that automatically extracts or scans archives. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Services such as antivirus scanners, file upload processors, CI/CD pipelines, and archive management tools that automatically handle user-supplied RAR5 files are particularly at risk, as a single malicious archive submission can render the service unresponsive (Red Hat Bugzilla, Feedly).

No privileges or user interaction are required to exploit this vulnerability, as it is triggered purely by submitting a crafted RAR5 archive to any service that processes it. A proof-of-concept archive demonstrating the deadlock was shared by the original reporter (Elhanan Haenel) with the libarchive maintainers during responsible disclosure, and the technical details are fully public via the GitHub pull request. The EPSS score is approximately 0.038% (0.000380), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of this report (GitHub PR #2877, Feedly).

1. Craft a malicious RAR5 archive: Create a RAR5 archive containing a filter block where block_length is set to a value greater than half the decompression window size (e.g., 70,000 bytes, which exceeds the 65,536-byte half-window limit for a 128 KB window) but below the 4 MB sanity cap. The archive must pass CRC and checksum validation to appear structurally valid.
2. Identify a target service: Locate a network-accessible service that automatically processes RAR5 archives using a vulnerable version of libarchive — such as a file upload endpoint, antivirus scanner, archive extraction API, or CI/CD artifact processor.
3. Submit the archive: Upload or transmit the crafted RAR5 file to the target service. No authentication is required if the service accepts unauthenticated file submissions.
4. Trigger the infinite loop: When the service calls archive_read_data() on the malicious archive, the uncompress_file() routine enters the deadlock state — the half-window limiter prevents forward progress, the filter never fires, and ARCHIVE_RETRY is returned indefinitely, consuming 100% of a CPU core.
5. Sustain the DoS: Repeat submissions with multiple crafted archives (or rely on the service's automatic retry/queue logic) to exhaust all available worker threads, rendering the service unresponsive (GitHub PR #2877, Red Hat Bugzilla).

• Process: A process linked against libarchive (e.g., bsdtar, antivirus daemons, file processing workers) showing sustained 100% CPU utilization on a single core with no forward progress, detectable via top, htop, or ps aux.
• Logs: Application logs showing repeated or hung archive extraction operations on the same RAR5 file with no completion or error; absence of expected completion log entries for archive processing jobs.
• Network: Repeated submissions of the same or similarly sized RAR5 file from an external IP to a file upload or archive processing endpoint, particularly if the service becomes unresponsive shortly after.
• File System: Presence of a suspicious RAR5 file in upload or temporary directories that remains unprocessed or causes the processing service to hang; the file will appear structurally valid and pass checksum tools.

The fix was merged into the libarchive master branch on March 10, 2026 (commit 78b632c, PR #2877), adding a check in parse_filter() that rejects filter blocks whose block_length exceeds half the decompression window size. Red Hat issued patches for RHEL 10 via RHSA-2026:5063 (libarchive-3.7.7-5.el10_1) and RHEL 9 via RHSA-2026:5080, with additional errata for OpenShift Container Platform 4.13–4.19, SAP Solutions update services, and Service Interconnect. Debian issued DLA-4563-1 for LTS, SUSE released SUSE-SU-2026:21757-1, and Ubuntu issued USN-8147-1. IBM addressed the issue in App Connect Enterprise Certified Container (node 7272299) and IBM MQ Operator/Queue Manager container images (node 7273145). Splunk addressed it in AppDynamics Cluster Agent (SVD-2026-0510). Organizations should upgrade libarchive to a patched version as the primary remediation; as a temporary workaround, restrict or disable processing of RAR5 archives from untrusted sources until patching is complete (GitHub PR #2877, Red Hat RHSA-2026:5063, IBM Advisory).

The vulnerability was responsibly disclosed by researcher Elhanan Haenel to the libarchive maintainers, who provided a detailed technical root-cause analysis and suggested fix. Maintainer kientzle and collaborator antekone (Grzegorz Antoniak) reviewed and merged the fix promptly. The issue received broad attention across Linux distribution security channels, with advisories from Red Hat, Debian, SUSE, Ubuntu, IBM, and Splunk issued within weeks of disclosure. German Linux security outlet pro-linux.de published multiple coverage articles on the DoS issue in libarchive (GitHub PR #2877, Red Hat Bugzilla).