The vulnerability CVE-2026-4111 affects the RAR5 archive decompression logic in the libarchive library, specifically within the archive_read_data() function. When processing a maliciously crafted RAR5 archive, the decompression routine can enter an infinite loop due to internal logic that prevents forward progress. Because the archive appears valid and passes checksum validation, affected applications cannot detect the issue prior to processing. This results in persistent CPU resource consumption, causing a denial-of-service condition. Red Hat has published multiple advisories for Red Hat Enterprise Linux 10 and OpenShift Container Platform 4.19, providing updated packages and container images that fix this issue.

Exploitation of this vulnerability leads to a denial-of-service condition by causing an infinite loop in the decompression process, which continuously consumes CPU resources. There is no impact on confidentiality or integrity. The vulnerability affects services that automatically process RAR5 archives using libarchive, potentially causing service disruption.

Red Hat has released security updates and patches for affected products, including Red Hat Enterprise Linux 10 and OpenShift Container Platform 4.19. Users should apply these official fixes promptly by updating to the latest packages and container images available through the appropriate Red Hat channels. For OpenShift Container Platform 4.19, users should upgrade to version 4.19.29 or later as advised in the Red Hat security advisories. Patch status is confirmed as fixed in these updates. No alternative mitigations or workarounds are indicated in the vendor advisories.