{"id":"CVE-2026-4111","aliases":["ALSA-2026:5063","ALSA-2026:5080","AZL-79886","BELL-CVE-2026-4111","CLSA-2026-1774375084","CLSA-2026-1774375835","DEBIAN-CVE-2026-4111","EUVD-2026-12031","GHSA-xrqh-48jh-pjv2","MGASA-2026-0241","MGASA-2026-0366","OESA-2026-1641","RHSA-2026:5063","RHSA-2026:5080","RHSA-2026:6647","RHSA-2026:7093","RHSA-2026:7105","RHSA-2026:7106","RHSA-2026:8865","RHSA-2026:8944","RLSA-2026:5063","RLSA-2026:5080","ROOT-OS-DEBIAN-12-CVE-2026-4111","SUSE-SU-2026:21757-1","SUSE-SU-2026:21831-1","SUSE-SU-2026:22241-1","SUSE-SU-2026:22248-1","SUSE-SU-2026:2490-1","SUSE-SU-2026:2599-1","UBUNTU-CVE-2026-4111","openSUSE-SU-2026:20797-1"],"status":"published","title":"Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive","description":"A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00771,"percentile":0.55925,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2026-03-13T11:45:20Z","modified":"2026-11-05T09:47:32Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"bsdtar","fixed_in":["3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libarchive","fixed_in":["3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libarchive-devel","fixed_in":["3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"bsdtar","fixed_in":["3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libarchive","fixed_in":["3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libarchive-devel","fixed_in":["3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libarchive","fixed_in":["3.7.7-5"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libarchive","fixed_in":["3.8.7-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libarchive","fixed_in":["3.8.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libarchive","fixed_in":["3.8.6-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcat","fixed_in":["3.5.3-6.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcpio","fixed_in":["3.5.3-6.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdtar","fixed_in":["3.5.3-6.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive","fixed_in":["3.5.3-6.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive-devel","fixed_in":["3.5.3-6.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdcat","fixed_in":["3.5.3-6.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdcpio","fixed_in":["3.5.3-6.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdtar","fixed_in":["3.5.3-6.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libarchive","fixed_in":["3.5.3-6.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libarchive-devel","fixed_in":["3.5.3-6.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libarchive","fixed_in":["3.6.2-1+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libarchive","fixed_in":["3.7.4-4+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libarchive","fixed_in":["3.8.6-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libarchive","fixed_in":["3.7.1-10.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libarchive","fixed_in":["3.4.3-13.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libarchive","fixed_in":["3.5.2-12.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libarchive","fixed_in":["3.7.1-10.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libarchive","fixed_in":["3.7.1-10.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"libarchive","fixed_in":["3.7.1-10.oe2403sp2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"bsdcat-debuginfo","fixed_in":["0:3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"bsdcpio-debuginfo","fixed_in":["0:3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"bsdtar","fixed_in":["0:3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"bsdtar-debuginfo","fixed_in":["0:3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"bsdunzip-debuginfo","fixed_in":["0:3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libarchive-debuginfo","fixed_in":["0:3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libarchive-debugsource","fixed_in":["0:3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libarchive-devel","fixed_in":["0:3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libarchive","fixed_in":["0:3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debugsource","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-devel","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debugsource","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-5.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-5.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdtar","fixed_in":["0:3.5.3-5.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-5.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-5.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libarchive-debugsource","fixed_in":["0:3.5.3-5.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-5.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-5.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-5.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive","fixed_in":["0:3.5.3-5.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-5.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive-debugsource","fixed_in":["0:3.5.3-5.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"bsdtar","fixed_in":["0:3.5.3-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libarchive-debugsource","fixed_in":["0:3.5.3-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libarchive","fixed_in":["0:3.5.3-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libarchive-debugsource","fixed_in":["0:3.5.3-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdtar","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-debugsource","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-devel","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive-debugsource","fixed_in":["0:3.5.3-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"bsdtar","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libarchive-debugsource","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libarchive-devel","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libarchive","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libarchive-debugsource","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libarchive-debugsource","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libarchive-devel","fixed_in":["0:3.5.3-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"libarchive","fixed_in":["0:3.7.7-5.el10_1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"libarchive","fixed_in":["0:3.5.3-7.el9_7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","fixed_in":["3.1.2-7ubuntu2.8+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","fixed_in":["3.1.2-11ubuntu0.16.04.8+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","fixed_in":["3.2.2-3.1ubuntu0.7+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libarchive","fixed_in":["3.4.0-2ubuntu1.5+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","fixed_in":["3.6.0-1ubuntu1.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","fixed_in":["3.7.2-2ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libarchive","fixed_in":["3.7.7-0ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-5"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.1-r1"},{"fixed":"3.8.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.0-r0"},{"fixed":"3.8.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.2-r1"},{"fixed":"3.8.6-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1+deb12u4"}]}],"versions":["3.6.2-1","3.6.2-1+deb12u1","3.6.2-1+deb12u2","3.6.2-1+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-4+deb13u1"}]}],"versions":["3.7.4-4"]},{"source":"osv","ecosystem":"Debian:14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6-1"}]}],"versions":["3.7.4-4","3.8.4-1","3.8.5-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.8-1.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-1.mga10"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-5.6.mga9"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-10.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-13.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-12.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-10.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-10.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-10.oe2403sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"bsdunzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdunzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.7-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.7-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-slfo.1.1_4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.8+esm4"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6","3.1.2-7ubuntu2.7","3.1.2-7ubuntu2.8","3.1.2-7ubuntu2.8+esm1","3.1.2-7ubuntu2.8+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.8+esm2"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4","3.1.2-11ubuntu0.16.04.5","3.1.2-11ubuntu0.16.04.6","3.1.2-11ubuntu0.16.04.7","3.1.2-11ubuntu0.16.04.8","3.1.2-11ubuntu0.16.04.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+esm2"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1","3.2.2-3.1ubuntu0.2","3.2.2-3.1ubuntu0.3","3.2.2-3.1ubuntu0.4","3.2.2-3.1ubuntu0.5","3.2.2-3.1ubuntu0.6","3.2.2-3.1ubuntu0.7","3.2.2-3.1ubuntu0.7+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.5+esm1"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2","3.4.0-2ubuntu1.3","3.4.0-2ubuntu1.4","3.4.0-2ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.6"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1","3.6.0-1ubuntu1.2","3.6.0-1ubuntu1.3","3.6.0-1ubuntu1.4","3.6.0-1ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.6"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1","3.7.2-2ubuntu0.2","3.7.2-2ubuntu0.3","3.7.2-2ubuntu0.4","3.7.2-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-0ubuntu3.1"}]}],"versions":["3.7.7-0ubuntu2","3.7.7-0ubuntu2.1","3.7.7-0ubuntu2.2","3.7.7-0ubuntu3"]}],"products":[{"vendor":"red hat","product":"cert manager support for red hat openshift release 1.18"},{"vendor":"red hat","product":"red hat ai inference server 3.2"},{"vendor":"red hat","product":"red hat ai inference server 3.3"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.0 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat insights proxy 1.5"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"red hat","product":"red hat openshift container platform 4.15"},{"vendor":"red hat","product":"red hat openshift container platform 4.16"},{"vendor":"red hat","product":"red hat openshift container platform 4.17"},{"vendor":"red hat","product":"red hat openshift container platform 4.18"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat update infrastructure 5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:10065","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10081","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10097","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14773","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:15087","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16008","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16009","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16174","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17596","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25096","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5063","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5080","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6647","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7093","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7105","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7106","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7239","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7329","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7335","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82347","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82354","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82372","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82857","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8423","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8746","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8747","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8748","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8865","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8944","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9832","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4111","tags":["vdb-entry","x_refsource_REDHAT","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446453","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/libarchive/libarchive/pull/2877","tags":["fix","article","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4111.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4111","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xrqh-48jh-pjv2"},{"url":"https://bugzilla.redhat.com/2446453","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-5063.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-5080.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-4111","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1774375084.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1774375835.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-4111","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0241.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35836","tags":["report"]},{"url":"https://github.com/libarchive/libarchive/releases/tag/v3.8.8","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2026-0366.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35999","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8581-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1641","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5063.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4111","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5080.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6647.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7093.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7105.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7106.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449006","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8865.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4424","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4424","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4424","tags":["advisory"]},{"url":"https://github.com/libarchive/libarchive/pull/2898","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-60753","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5121","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5745","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4426","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8944.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2412648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-60753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60753","tags":["advisory"]},{"url":"https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753","tags":["article"]},{"url":"https://github.com/libarchive/libarchive/issues/2725","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449010","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4426","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4426","tags":["advisory"]},{"url":"https://github.com/libarchive/libarchive/pull/2897","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452945","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5121","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2vwv-vqpv-v8vc","tags":["advisory"]},{"url":"https://github.com/libarchive/libarchive/pull/2934","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5745","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:5063","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:5080","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621757-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259635","tags":["report"]},{"url":"https://bugzilla.suse.com/1259928","tags":["report"]},{"url":"https://bugzilla.suse.com/1259931","tags":["report"]},{"url":"https://bugzilla.suse.com/1261186","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5121","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621831-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622241-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253088","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-60753","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622248-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262490-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262599-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-4111","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8147-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-4111","title":"Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive","description":"A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.","status":"published","published":"2026-03-13T11:45:20.653Z","modified":"2026-11-04T22:44:17.476Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-835","CWE-835"],"updated_at":"2026-11-04T23:40:09.798467Z"}],"euvd":[{"id":"EUVD-2026-12031","description":"A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.","status":"published","published":"2026-03-13T11:45:20Z","modified":"2026-11-04T22:44:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T00:47:41.139684Z"}],"ghsa":[{"id":"GHSA-xrqh-48jh-pjv2","title":"A flaw was identified in the RAR5 archive decompression logic of the libarchive library,...","description":"A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.","status":"published","published":"2026-03-13T21:31:51Z","modified":"2026-10-14T21:33:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:13:29.286626Z"}],"nvd":[{"id":"CVE-2026-4111","description":"A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.","status":"published","published":"2026-03-13T19:55:13.917Z","modified":"2026-11-04T23:17:35.48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-05T01:45:09.431178Z"}],"osv":[{"id":"BELL-CVE-2026-4111","status":"published","published":"2026-03-14T06:07:48.1361Z","modified":"2026-05-06T07:19:49.039853Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-4111","description":"A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.","status":"published","published":"2026-03-13T19:55:13.917Z","modified":"2026-06-26T18:29:21.913773022Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"DEBIAN-CVE-2026-4111","description":"A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.","status":"published","published":"2026-03-13T19:55:13.917Z","modified":"2026-11-05T09:47:32.040293299Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2026-1641","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.(CVE-2026-4111)","status":"published","published":"2026-03-20T11:10:40Z","modified":"2026-08-18T01:19:41.367314203Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"RHSA-2026:5063","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-07T10:08:29Z","modified":"2026-10-15T10:20:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:5080","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-03-20T10:19:34Z","modified":"2026-10-15T10:20:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:6647","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-06T10:06:42Z","modified":"2026-10-15T10:24:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:7093","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-09T10:11:52Z","modified":"2026-10-15T10:25:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7105","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-09T10:11:53Z","modified":"2026-10-15T10:25:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7106","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-09T10:11:53Z","modified":"2026-10-15T10:25:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:8865","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-20T10:12:27Z","modified":"2026-10-15T10:29:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8944","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:10:50Z","modified":"2026-10-15T10:29:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2026:5063","title":"Important: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive (CVE-2026-4111)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-03-27T12:07:50.770013Z","modified":"2026-03-27T12:30:52.575036Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:5080","title":"Important: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive (CVE-2026-4111)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-03-26T18:03:52.468416Z","modified":"2026-03-26T18:30:15.413171Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-4111","description":"A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.","status":"published","published":"2026-03-13T19:55:00Z","modified":"2026-04-22T16:34:35.50002Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"ALSA-2026:5063","title":"Important: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.  \n\nSecurity Fix(es):  \n\n  * libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive (CVE-2026-4111)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-03-19T00:00:00Z","modified":"2026-10-29T11:58:12.862745Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:5080","title":"Important: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.  \n\nSecurity Fix(es):  \n\n  * libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive (CVE-2026-4111)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-03-19T00:00:00Z","modified":"2026-10-29T11:32:36.368541963Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-79886","title":"CVE-2026-4111 affecting package libarchive for versions less than 3.7.7-5","description":"A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.","status":"published","published":"2026-03-13T19:55:13Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1774375084","title":"libarchive: Fix of CVE-2026-4111","description":"- CVE-2026-4111: Fix infinite loop in RAR5 decompression caused by block_length\n  exceeding half the window size, leading to CPU-consuming denial-of-service","status":"published","published":"2026-03-24T17:58:08Z","modified":"2026-06-01T00:32:10.242374875Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774375835","title":"libarchive: Fix of CVE-2026-4111","description":"- CVE-2026-4111: Fix infinite loop in RAR5 decompression caused by block_length\n  exceeding half the window size, leading to CPU-consuming denial-of-service","status":"published","published":"2026-03-24T18:10:40Z","modified":"2026-06-01T00:32:45.922045613Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"MGASA-2026-0241","title":"Updated libarchive packages fix security vulnerabilities","description":"The updated packages fix bugs including security ones.\n","status":"published","published":"2026-07-11T20:43:25Z","modified":"2026-07-11T20:45:04.766306553Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"MGASA-2026-0366","title":"Updated libarchive packages fix security vulnerabilities","description":"Double-free vulnerability in rar5 decompression logic via dangling\nfiltered_buf pointer in init_unpack(). (CVE-2026-14164)\nHeap overflow oob read while parsing a tar archive contains a pax\nextended header. (CVE-2026-15028)\nA null pointer dereference vulnerability exists in the acl parser of\nlibarchive. (CVE-2026-5745)\nReading past eof may be triggered for piped file streams.\n(CVE-2025-5918)\nAn issue was discovered in libarchive bsdtar before version 3.8.1 in\nfunction apply_substitution in file tar/subst.c when processing crafted\n-s substitution rules. This can cause unbounded memory allocation and\nlead to denial of service (Out-of-Memory crash). (CVE-2025-60753)\nInfinite loop denial of service in rar5 decompression via\narchive_read_data() in libarchive. (CVE-2026-4111)\nInformation disclosure via heap out-of-bounds read in rar archive\nprocessing. (CVE-2026-4424)\nDenial of service via malformed iso file processing. (CVE-2026-4426)\nArbitrary code execution via integer overflow in iso9660 image\nprocessing. (CVE-2026-5121)\n","status":"published","published":"2026-09-02T16:59:28Z","modified":"2026-09-02T17:11:17.793563615Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:20797-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).\n","status":"published","published":"2026-05-25T07:40:16Z","modified":"2026-05-28T18:24:16.320109375Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-4111","title":"CVE-2026-4111 in rootio-libarchive - Patched by Root","description":"Root has patched CVE-2026-4111 in the rootio-libarchive package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-03-19T07:09:00Z","modified":"2026-08-27T14:00:08.217096819Z","updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"SUSE-SU-2026:21757-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).\n","status":"published","published":"2026-05-25T07:42:39Z","modified":"2026-05-27T18:24:07.334293113Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21831-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).\n","status":"published","published":"2026-05-25T07:42:39Z","modified":"2026-05-28T18:24:13.454050961Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22241-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).\n","status":"published","published":"2026-06-18T08:00:49Z","modified":"2026-06-26T18:24:10.318829274Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22248-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).\n","status":"published","published":"2026-06-22T09:04:46Z","modified":"2026-06-26T18:24:14.275714745Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2490-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).\n","status":"published","published":"2026-06-22T12:34:31Z","modified":"2026-06-24T09:00:13.168795898Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2599-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).\n","status":"published","published":"2026-06-23T15:41:04Z","modified":"2026-06-24T09:00:18.645923961Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}