CVE-2026-4111

High

Advisory

Published 13 Mar 2026In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 105; of 17,781 indexed, latest versions
Container images: 126; deployed by those charts
Fix available: 2 of 2; affected packages

Red Hat Security Advisory: libarchive security update

Carried by container images the latest versions of 105 of 17,781 indexed charts deploy, on 126 images.

Affected package	Affected versions	Fixed in	Images
libarchiverpm	3.5.3-3.el9, 3.5.3-4.el9, 3.5.3-4.el9.0.1, 3.5.3-5.el9_6+2 more	0:3.5.3-7.el9_7, 0:3.7.7-5.el10_1	93
libarchivedeb	3.1.2-11ubuntu0.16.04.3, 3.4.0-2ubuntu1, 3.4.0-2ubuntu1.2, 3.4.0-2ubuntu1.5+11 more	3.1.2-11ubuntu0.16.04.8+esm2, 3.4.0-2ubuntu1.5+esm1, 3.6.0-1ubuntu1.6, 3.6.2-1+deb12u4+3 more	33

OSV records: DEBIAN-CVE-2026-4111 RHSA-2026:5063 RHSA-2026:5080 RLSA-2026:5080 UBUNTU-CVE-2026-4111
Also known as: RHSA-2026:6647, RHSA-2026:7105, RHSA-2026:7106, USN-8147-1

Charts affected

105 by stars

Chart

Latest

Affected images

Radar Score

stash-boxswuuper-github

0.1.1

1 of 2 See more

stash-box swuuper-github 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-4111.

Container image	Digest	Package	Fixed in
stashapp/stash-box :latest	a534c8afdf39	libarchive@3.7.2-2ubuntu0.4	3.7.2-2ubuntu0.6

Open the chart page →

8,193

owncloudth-charts

0.2.1

1 of 1 See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-4111.

Container image	Digest	Package	Fixed in
owncloud/server :10.15.0	51d9b74fc2a8	libarchive@3.4.0-2ubuntu1.2	3.4.0-2ubuntu1.5+esm1

Open the chart page →

10,006

opencloudunxwares

0.2.3

1 of 13 See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-4111.

Container image	Digest	Package	Fixed in
apache/tika :2.9.2.1-full	ae0b86d3c4d0	libarchive@3.7.2-2	3.7.2-2ubuntu0.6

Open the chart page →

45,239

myweatherhelmwebapp1

1.3.50

1 of 8 See more

myweatherhelm webapp1 1.3.50

1 of the 8 container images this version deploys carry CVE-2026-4111.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	libarchive@3.4.0-2ubuntu1.2	3.4.0-2ubuntu1.5+esm1

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

1 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

1 of the 9 container images this version deploys carry CVE-2026-4111.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	libarchive@3.4.0-2ubuntu1.2	3.4.0-2ubuntu1.5+esm1

Open the chart page →

9,130

Container images carrying it

126 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/devops-ia/cp-schema-registry :8.1.1-msk-iam-auth2.3.5	30d1a445acc7	libarchive@3.5.3-6.el9_6	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/authentication-service :0.11.0	857b137fc7b3	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/coap-endpoint :0.11.0	44790b71aa22	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/command-endpoint :0.11.0	6dce3158b851	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/console-backend :0.11.0	25d229ae5bde	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/console-frontend :0.11.0	558972f9374c	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/database-migration :0.11.0	57072c72a7cd	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/device-management-controller :0.11.0	200aea1a2b42	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/device-management-service :0.11.0	f4a5bfc06a74	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/device-state-service :0.11.0	fbf0738cfc7e	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/http-endpoint :0.11.0	b612c18479e0	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/knative-operator :0.11.0	e2d927639f6e	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/mqtt-endpoint :0.11.0	32c6d2f5eab9	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/mqtt-integration :0.11.0	7ac2adb6ca49	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/outbox-controller :0.11.0	1a958edafdb1	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/topic-strimzi-operator :0.11.0	5253fbf8d04c	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/ttn-operator :0.11.0	7dd5ac80c8f1	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/user-auth-service :0.11.0	adebc40ddf98	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/drogue-iot/websocket-integration :0.11.0	372dcd370945	libarchive@3.5.3-3.el9	0:3.5.3-7.el9_7	1
ghcr.io/grafana/alloy-operator :1.3.0	2088dcb22aaa	libarchive@3.5.3-5.el9_6	0:3.5.3-7.el9_7	1
ghcr.io/grafana/alloy-operator :1.7.0	2ce23f948e02	libarchive@3.5.3-6.el9_6	0:3.5.3-7.el9_7	1
ghcr.io/grafana/alloy-operator :1.8.1	ae85d68749c7	libarchive@3.5.3-6.el9_6	0:3.5.3-7.el9_7	1
ghcr.io/haveagitgat/tdarr :2.00.18.2	3fbe4c29d14c	libarchive@3.4.0-2ubuntu1.2	3.4.0-2ubuntu1.5+esm1	1
ghcr.io/it-at-m/dave-document-storage/dave-document-storage :10.0.0	9c7fc07330c9	libarchive@3.5.3-6.el9_6	0:3.5.3-7.el9_7	1
ghcr.io/it-at-m/kf-app-eai :1.0.6	5de339b3d537	libarchive@3.5.3-6.el9_6	0:3.5.3-7.el9_7	1
ghcr.io/it-at-m/wjh-rechner :1.0.0	bc70cdb5a01a	libarchive@3.5.3-4.el9	0:3.5.3-7.el9_7	1
ghcr.io/k8s-at-home/apache-musicindex :v1.4.1-2	c9bd82dc5fda	libarchive@3.4.0-2ubuntu1.2	3.4.0-2ubuntu1.5+esm1	1
ghcr.io/k8s-at-home/xteve :v2.2.0.200	292b3614670f	libarchive@3.4.0-2ubuntu1.2	3.4.0-2ubuntu1.5+esm1	1
ghcr.io/kanisterio/controller :0.118.0	d22616a5998b	libarchive@3.5.3-6.el9_6	0:3.5.3-7.el9_7	1
ghcr.io/kluster-manager/managed-serviceaccount :v0.10.0	fc256885915b	libarchive@3.5.3-6.el9_6	0:3.5.3-7.el9_7	1
ghcr.io/kluster-manager/registration-operator :v1.2.0	0cbced8e6240	libarchive@3.5.3-6.el9_6	0:3.5.3-7.el9_7	1
ghcr.io/llm-d/llm-d-model-service :v0.0.15	8b99a8104a2f	libarchive@3.5.3-4.el9	0:3.5.3-7.el9_7	1
ghcr.io/microboxlabs/miot-calendar :latest-jvm	7157cdc0bf5b	libarchive@3.5.3-6.el9_6	0:3.5.3-7.el9_7	1
ghcr.io/microboxlabs/miot-srv :latest	4ec11d229028	libarchive@3.5.3-6.el9_6	0:3.5.3-7.el9_7	1
ghcr.io/microboxlabs/miot-srv :latest	5796553b41ae	libarchive@3.5.3-6.el9_6	0:3.5.3-7.el9_7	1
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	libarchive@3.6.2-1+deb12u1	3.6.2-1+deb12u4	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	libarchive@3.7.4-4	3.7.4-4+deb13u1	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	libarchive@3.7.4-4	3.7.4-4+deb13u1	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	libarchive@3.7.4-4	3.7.4-4+deb13u1	1
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	libarchive@3.6.2-1	3.6.2-1+deb12u4	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	libarchive@3.7.4-4	3.7.4-4+deb13u1	1
ghcr.io/projectnessie/nessie :0.92.1	9efe3c74d55f	libarchive@3.5.3-4.el9	0:3.5.3-7.el9_7	1
mcr.microsoft.com/mssql/server :2019-CU16-ubuntu-20.04	49a57dc220b1	libarchive@3.4.0-2ubuntu1.2	3.4.0-2ubuntu1.5+esm1	1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka :8.1.0-1-ubi9	9026dbbf280d	libarchive@3.5.3-6.el9_6	0:3.5.3-7.el9_7	1
public.ecr.aws/perfectscale-io/psc-exporter :v1.0.45-redhat	9083e60c38bc	libarchive@3.5.3-4.el9	0:3.5.3-7.el9_7	1
public.ecr.aws/perfectscale-io/ubi9/ubi :9.5	d7c3def9252b	libarchive@3.5.3-4.el9	0:3.5.3-7.el9_7	1
public.ecr.aws/v0r6c2e2/hive-metastore :latest	794b3bff9510	libarchive@3.5.3-4.el9	0:3.5.3-7.el9_7	1
public.ecr.aws/v0r6c2e2/trino :latest	c265156b00d1	libarchive@3.5.3-4.el9	0:3.5.3-7.el9_7	1
quay.io/ai-lab/llamacpp_python :latest	70d138997acd	libarchive@3.5.3-4.el9	0:3.5.3-7.el9_7	1
quay.io/everythingascode/apishift-backend :v0.3.0	14ff275b2e61	libarchive@3.5.3-4.el9	0:3.5.3-7.el9_7	1