The libarchive library in Red Hat Enterprise Linux 10 and 9 contains a vulnerability (CVE-2026-4111) in the RAR5 decompression logic. Specifically, the archive_read_data() processing path can enter an infinite loop when handling a specially crafted RAR5 archive. This infinite loop causes persistent CPU resource consumption, effectively resulting in a denial-of-service condition. The crafted archive passes checksum validation and appears valid, so affected applications cannot detect the issue prior to processing. Red Hat has issued security advisories RHSA-2026:5063 for RHEL 10 and RHSA-2026:5080 for RHEL 9, providing updated libarchive packages that fix this vulnerability.

This vulnerability allows an attacker to cause a denial-of-service (DoS) condition by triggering an infinite loop in the libarchive RAR5 decompression routine. The impact is limited to availability, with no confidentiality or integrity effects reported. Services or applications that automatically process RAR5 archives using libarchive may experience persistent CPU resource exhaustion, potentially disrupting normal operations.

Red Hat has released official security updates for libarchive in Red Hat Enterprise Linux 10 and 9 that address this vulnerability. Users should apply the updated libarchive packages as detailed in Red Hat advisories RHSA-2026:5063 and RHSA-2026:5080. The advisories provide instructions and links for obtaining and installing the patches. Applying these updates mitigates the infinite loop denial-of-service issue. No additional mitigation steps are indicated by the vendor.