OESA-2026-1641

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1641

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-1641.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-1641

Upstream

CVE-2026-4111

Published

2026-03-20T14:23:14Z

Modified

2026-03-20T14:32:42.938849Z

Summary

libarchive security update

Details

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archivereaddata() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.(CVE-2026-4111)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:20.03-LTS-SP4

libarchive

Package

Name: libarchive
Purl: pkg:rpm/openEuler/libarchive&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.4.3-13.oe2003sp4

Ecosystem specific

{
    "aarch64": [
        "libarchive-3.4.3-13.oe2003sp4.aarch64.rpm",
        "libarchive-debuginfo-3.4.3-13.oe2003sp4.aarch64.rpm",
        "libarchive-debugsource-3.4.3-13.oe2003sp4.aarch64.rpm",
        "libarchive-devel-3.4.3-13.oe2003sp4.aarch64.rpm"
    ],
    "x86_64": [
        "libarchive-3.4.3-13.oe2003sp4.x86_64.rpm",
        "libarchive-debuginfo-3.4.3-13.oe2003sp4.x86_64.rpm",
        "libarchive-debugsource-3.4.3-13.oe2003sp4.x86_64.rpm",
        "libarchive-devel-3.4.3-13.oe2003sp4.x86_64.rpm"
    ],
    "noarch": [
        "libarchive-help-3.4.3-13.oe2003sp4.noarch.rpm"
    ],
    "src": [
        "libarchive-3.4.3-13.oe2003sp4.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1641.json"

openEuler:22.03-LTS-SP4

libarchive

Package

Name: libarchive
Purl: pkg:rpm/openEuler/libarchive&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.5.2-12.oe2203sp4

Ecosystem specific

{
    "aarch64": [
        "bsdcat-3.5.2-12.oe2203sp4.aarch64.rpm",
        "bsdcpio-3.5.2-12.oe2203sp4.aarch64.rpm",
        "bsdtar-3.5.2-12.oe2203sp4.aarch64.rpm",
        "libarchive-3.5.2-12.oe2203sp4.aarch64.rpm",
        "libarchive-debuginfo-3.5.2-12.oe2203sp4.aarch64.rpm",
        "libarchive-debugsource-3.5.2-12.oe2203sp4.aarch64.rpm",
        "libarchive-devel-3.5.2-12.oe2203sp4.aarch64.rpm"
    ],
    "x86_64": [
        "bsdcat-3.5.2-12.oe2203sp4.x86_64.rpm",
        "bsdcpio-3.5.2-12.oe2203sp4.x86_64.rpm",
        "bsdtar-3.5.2-12.oe2203sp4.x86_64.rpm",
        "libarchive-3.5.2-12.oe2203sp4.x86_64.rpm",
        "libarchive-debuginfo-3.5.2-12.oe2203sp4.x86_64.rpm",
        "libarchive-debugsource-3.5.2-12.oe2203sp4.x86_64.rpm",
        "libarchive-devel-3.5.2-12.oe2203sp4.x86_64.rpm"
    ],
    "noarch": [
        "libarchive-help-3.5.2-12.oe2203sp4.noarch.rpm"
    ],
    "src": [
        "libarchive-3.5.2-12.oe2203sp4.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1641.json"

openEuler:24.03-LTS

libarchive

Package

Name: libarchive
Purl: pkg:rpm/openEuler/libarchive&distro=openEuler-24.03-LTS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.7.1-10.oe2403sp2

Ecosystem specific

{
    "aarch64": [
        "bsdcat-3.7.1-10.oe2403sp3.aarch64.rpm",
        "bsdcpio-3.7.1-10.oe2403sp3.aarch64.rpm",
        "bsdtar-3.7.1-10.oe2403sp3.aarch64.rpm",
        "bsdunzip-3.7.1-10.oe2403sp3.aarch64.rpm",
        "libarchive-3.7.1-10.oe2403sp3.aarch64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403sp3.aarch64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403sp3.aarch64.rpm",
        "libarchive-devel-3.7.1-10.oe2403sp3.aarch64.rpm",
        "bsdcat-3.7.1-10.oe2403.aarch64.rpm",
        "bsdcpio-3.7.1-10.oe2403.aarch64.rpm",
        "bsdtar-3.7.1-10.oe2403.aarch64.rpm",
        "bsdunzip-3.7.1-10.oe2403.aarch64.rpm",
        "libarchive-3.7.1-10.oe2403.aarch64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403.aarch64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403.aarch64.rpm",
        "libarchive-devel-3.7.1-10.oe2403.aarch64.rpm",
        "bsdcat-3.7.1-10.oe2403sp1.aarch64.rpm",
        "bsdcpio-3.7.1-10.oe2403sp1.aarch64.rpm",
        "bsdtar-3.7.1-10.oe2403sp1.aarch64.rpm",
        "bsdunzip-3.7.1-10.oe2403sp1.aarch64.rpm",
        "libarchive-3.7.1-10.oe2403sp1.aarch64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403sp1.aarch64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403sp1.aarch64.rpm",
        "libarchive-devel-3.7.1-10.oe2403sp1.aarch64.rpm",
        "bsdcat-3.7.1-10.oe2403sp2.aarch64.rpm",
        "bsdcpio-3.7.1-10.oe2403sp2.aarch64.rpm",
        "bsdtar-3.7.1-10.oe2403sp2.aarch64.rpm",
        "bsdunzip-3.7.1-10.oe2403sp2.aarch64.rpm",
        "libarchive-3.7.1-10.oe2403sp2.aarch64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403sp2.aarch64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403sp2.aarch64.rpm",
        "libarchive-devel-3.7.1-10.oe2403sp2.aarch64.rpm"
    ],
    "x86_64": [
        "bsdcat-3.7.1-10.oe2403sp3.x86_64.rpm",
        "bsdcpio-3.7.1-10.oe2403sp3.x86_64.rpm",
        "bsdtar-3.7.1-10.oe2403sp3.x86_64.rpm",
        "bsdunzip-3.7.1-10.oe2403sp3.x86_64.rpm",
        "libarchive-3.7.1-10.oe2403sp3.x86_64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403sp3.x86_64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403sp3.x86_64.rpm",
        "libarchive-devel-3.7.1-10.oe2403sp3.x86_64.rpm",
        "bsdcat-3.7.1-10.oe2403.x86_64.rpm",
        "bsdcpio-3.7.1-10.oe2403.x86_64.rpm",
        "bsdtar-3.7.1-10.oe2403.x86_64.rpm",
        "bsdunzip-3.7.1-10.oe2403.x86_64.rpm",
        "libarchive-3.7.1-10.oe2403.x86_64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403.x86_64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403.x86_64.rpm",
        "libarchive-devel-3.7.1-10.oe2403.x86_64.rpm",
        "bsdcat-3.7.1-10.oe2403sp1.x86_64.rpm",
        "bsdcpio-3.7.1-10.oe2403sp1.x86_64.rpm",
        "bsdtar-3.7.1-10.oe2403sp1.x86_64.rpm",
        "bsdunzip-3.7.1-10.oe2403sp1.x86_64.rpm",
        "libarchive-3.7.1-10.oe2403sp1.x86_64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403sp1.x86_64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403sp1.x86_64.rpm",
        "libarchive-devel-3.7.1-10.oe2403sp1.x86_64.rpm",
        "bsdcat-3.7.1-10.oe2403sp2.x86_64.rpm",
        "bsdcpio-3.7.1-10.oe2403sp2.x86_64.rpm",
        "bsdtar-3.7.1-10.oe2403sp2.x86_64.rpm",
        "bsdunzip-3.7.1-10.oe2403sp2.x86_64.rpm",
        "libarchive-3.7.1-10.oe2403sp2.x86_64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403sp2.x86_64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403sp2.x86_64.rpm",
        "libarchive-devel-3.7.1-10.oe2403sp2.x86_64.rpm"
    ],
    "noarch": [
        "libarchive-help-3.7.1-10.oe2403sp3.noarch.rpm",
        "libarchive-help-3.7.1-10.oe2403.noarch.rpm",
        "libarchive-help-3.7.1-10.oe2403sp1.noarch.rpm",
        "libarchive-help-3.7.1-10.oe2403sp2.noarch.rpm"
    ],
    "src": [
        "libarchive-3.7.1-10.oe2403sp3.src.rpm",
        "libarchive-3.7.1-10.oe2403.src.rpm",
        "libarchive-3.7.1-10.oe2403sp1.src.rpm",
        "libarchive-3.7.1-10.oe2403sp2.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1641.json"

openEuler:24.03-LTS-SP1

libarchive

Package

Name: libarchive
Purl: pkg:rpm/openEuler/libarchive&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.7.1-10.oe2403sp1

Ecosystem specific

{
    "aarch64": [
        "bsdcat-3.7.1-10.oe2403sp1.aarch64.rpm",
        "bsdcpio-3.7.1-10.oe2403sp1.aarch64.rpm",
        "bsdtar-3.7.1-10.oe2403sp1.aarch64.rpm",
        "bsdunzip-3.7.1-10.oe2403sp1.aarch64.rpm",
        "libarchive-3.7.1-10.oe2403sp1.aarch64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403sp1.aarch64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403sp1.aarch64.rpm",
        "libarchive-devel-3.7.1-10.oe2403sp1.aarch64.rpm"
    ],
    "x86_64": [
        "bsdcat-3.7.1-10.oe2403sp1.x86_64.rpm",
        "bsdcpio-3.7.1-10.oe2403sp1.x86_64.rpm",
        "bsdtar-3.7.1-10.oe2403sp1.x86_64.rpm",
        "bsdunzip-3.7.1-10.oe2403sp1.x86_64.rpm",
        "libarchive-3.7.1-10.oe2403sp1.x86_64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403sp1.x86_64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403sp1.x86_64.rpm",
        "libarchive-devel-3.7.1-10.oe2403sp1.x86_64.rpm"
    ],
    "noarch": [
        "libarchive-help-3.7.1-10.oe2403sp1.noarch.rpm"
    ],
    "src": [
        "libarchive-3.7.1-10.oe2403sp1.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1641.json"

openEuler:24.03-LTS-SP2

libarchive

Package

Name: libarchive
Purl: pkg:rpm/openEuler/libarchive&distro=openEuler-24.03-LTS-SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.7.1-10.oe2403sp2

Ecosystem specific

{
    "aarch64": [
        "bsdcat-3.7.1-10.oe2403sp2.aarch64.rpm",
        "bsdcpio-3.7.1-10.oe2403sp2.aarch64.rpm",
        "bsdtar-3.7.1-10.oe2403sp2.aarch64.rpm",
        "bsdunzip-3.7.1-10.oe2403sp2.aarch64.rpm",
        "libarchive-3.7.1-10.oe2403sp2.aarch64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403sp2.aarch64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403sp2.aarch64.rpm",
        "libarchive-devel-3.7.1-10.oe2403sp2.aarch64.rpm"
    ],
    "x86_64": [
        "bsdcat-3.7.1-10.oe2403sp2.x86_64.rpm",
        "bsdcpio-3.7.1-10.oe2403sp2.x86_64.rpm",
        "bsdtar-3.7.1-10.oe2403sp2.x86_64.rpm",
        "bsdunzip-3.7.1-10.oe2403sp2.x86_64.rpm",
        "libarchive-3.7.1-10.oe2403sp2.x86_64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403sp2.x86_64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403sp2.x86_64.rpm",
        "libarchive-devel-3.7.1-10.oe2403sp2.x86_64.rpm"
    ],
    "noarch": [
        "libarchive-help-3.7.1-10.oe2403sp2.noarch.rpm"
    ],
    "src": [
        "libarchive-3.7.1-10.oe2403sp2.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1641.json"

openEuler:24.03-LTS-SP3

libarchive

Package

Name: libarchive
Purl: pkg:rpm/openEuler/libarchive&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.7.1-10.oe2403sp3

Ecosystem specific

{
    "aarch64": [
        "bsdcat-3.7.1-10.oe2403sp3.aarch64.rpm",
        "bsdcpio-3.7.1-10.oe2403sp3.aarch64.rpm",
        "bsdtar-3.7.1-10.oe2403sp3.aarch64.rpm",
        "bsdunzip-3.7.1-10.oe2403sp3.aarch64.rpm",
        "libarchive-3.7.1-10.oe2403sp3.aarch64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403sp3.aarch64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403sp3.aarch64.rpm",
        "libarchive-devel-3.7.1-10.oe2403sp3.aarch64.rpm"
    ],
    "x86_64": [
        "bsdcat-3.7.1-10.oe2403sp3.x86_64.rpm",
        "bsdcpio-3.7.1-10.oe2403sp3.x86_64.rpm",
        "bsdtar-3.7.1-10.oe2403sp3.x86_64.rpm",
        "bsdunzip-3.7.1-10.oe2403sp3.x86_64.rpm",
        "libarchive-3.7.1-10.oe2403sp3.x86_64.rpm",
        "libarchive-debuginfo-3.7.1-10.oe2403sp3.x86_64.rpm",
        "libarchive-debugsource-3.7.1-10.oe2403sp3.x86_64.rpm",
        "libarchive-devel-3.7.1-10.oe2403sp3.x86_64.rpm"
    ],
    "noarch": [
        "libarchive-help-3.7.1-10.oe2403sp3.noarch.rpm"
    ],
    "src": [
        "libarchive-3.7.1-10.oe2403sp3.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1641.json"