An Infinite Loop Denial-of-Service vulnerability exists in the RAR5 decompression implementation of libarchive. The flaw occurs in the uncompress_file() routine within archive_read_support_format_rar5.c due to a logical deadlock between the filter activation threshold and the half-window output limiter. When a specially crafted RAR5 archive is processed through archive_read_data(), the decompressor enters a state where neither the filter activation condition nor the output window progress condition can be satisfied. As a result, the loop continues indefinitely while consuming 100% CPU. Because the archive passes all CRC and checksum validation, the issue can be triggered using a valid-looking archive without authentication or user interaction. This allows attackers to exhaust worker threads or processing pipelines in applications that automatically extract or scan archives.
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:5063 https://access.redhat.com/errata/RHSA-2026:5063
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:5080 https://access.redhat.com/errata/RHSA-2026:5080