GHSA-xrqh-48jh-pjv2 · Severity: high — A flaw was identified in the RAR5 archive decompression logic of the libarchive library,...
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.
Conclusion & alert: CVE-2026-4111 is rated Low Risk (31.7/100): CVSS High severity, with low exploitation likelihood (EPSS 0.02%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-21 | 0.06% | 0.02% | -0.04% |
| 2 | 2026-03-19 | 0.04% | 0.06% | +0.02% |
| 3 | 2026-03-13 | — | 0.04% | — |
Full EPSS history (3 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
GHSA-xrqh-48jh-pjv2 · Severity: high — A flaw was identified in the RAR5 archive decompression logic of the libarchive library,...
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2026-4111 not yet assigned priority: Debian including 1 source packages (libarchive), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2026-4111 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2026-4111 |
suse
|
high | CVE-2026-4111 severity important: SUSE including 10 source package names (bsdtar-3.5.3-7.el9_7, bsdtar-3.7.7-5.el10_1, …), 22 product×package rows across 9 product lines (SUSE Liberty Linux 10, SUSE Liberty Linux 9, … (9 product lines)): Known Not Affected 16, Fixed 6. | https://www.suse.com/security/cve/CVE-2026-4111/ |
ubuntu
|
medium | CVE-2026-4111 medium priority: Ubuntu including 1 source packages (libarchive), 8 status rows across 8 suites (bionic, focal, jammy, noble, questing, trusty, upstream, xenial): released 8. | https://ubuntu.com/security/CVE-2026-4111 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||