libarchive 3.8.7 GHSA-r3fp-vrpw-pg77

[frezbo]

Vulnerability ID:
GHSA-r3fp-vrpw-pg77
GHSA-fjqv-vj6q-4fcm (wrong report)

See https://github.com/libarchive/libarchive/releases/tag/v3.8.7

These are the fix commits:

* libarchive/libarchive#2900

• iso9660: validate pz_log2_bs in parse_rockridge_ZF1() libarchive/libarchive#2897

[frezbo]

I could be wrong about CVE-2026-5745, so that needs more additional information

[frezbo]

Further analysis shows only GHSA-r3fp-vrpw-pg77 is fixed, updating issue

[wagoodman]

What did you scan that produced the false positive? Can you provide the docker image (with digest) or a purl/cpe that reproduces this FP in the scan result?

[frezbo]

An example output:

22.01 [0021] ERROR discovered vulnerabilities at or above the severity threshold
22.01 NAME    INSTALLED  FIXED IN  VULNERABILITY   SEVERITY  EPSS          RISK   
22.01 kernel  6.18.25    6.19.11   CVE-2026-31560  Medium    < 0.1% (4th)  < 0.1  
22.01 kernel  6.18.25    7.0.1     CVE-2026-31574  Medium    < 0.1% (4th)  < 0.1  
22.01 libcap  2.78                 CVE-2026-4878   High      < 0.1% (0th)  < 0.1

More details can be seen here: https://github.com/siderolabs/talos/actions/runs/25051911618/job/73537818278

[frezbo]

Oops apologies, I sent the wrong one, give me some time to find the right one

[frezbo]

27.00 libarchive  3.8.7                       CVE-2026-4426   Medium    0.1% (32nd)    < 0.1
27.00 kernel      6.18.25    6.19.11          CVE-2026-31501  Critical  < 0.1% (17th)  < 0.1
27.00 kernel      6.18.25    *6.19.14, 7.0.1  CVE-2026-31589  Critical  < 0.1% (12th)  < 0.1
27.00 libarchive  3.8.7                       CVE-2026-5745   Medium    < 0.1% (5th)   < 0.1
27.00 kernel      6.18.25    6.19.11          CVE-2026-31560  Medium    < 0.1% (2nd)   < 0.1

I lost where it found this, I just have this from my clipboard history

[frezbo]

This shows that for 3.8.7 CVE-2026-4426 is reported still

[frezbo]

Okay, I was able to generate the full log:

grype-scan.log

[frezbo]

talos-arm64.spdx.json

and the sbom, which has cpe

[frezbo]

Another false report: CVE-2026-4424

Fix landed in 3.8.7

See https://github.com/libarchive/libarchive/releases/tag/v3.8.7 and libarchive/libarchive#2898