CVE-2016-7166: libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attacker...

Security readout for executives and security teams

CVE-2016-7166 is a denial-of-service flaw in libarchive before 3.2.0. A specially crafted gzip file can trigger repeated recursive decompression, consuming memory and crashing the application that processes it. This is primarily an availability risk for services that accept or automatically scan untrusted compressed files. Exposure is most likely where libarchive before 3.2.0 processes attacker-supplied gzip or archive content, including upload handling, automated extraction, indexing, scanning, or package-processing workflows. The source bundle does not identify specific deployed applications beyond libarchive and vendor package advisories. Treat as a moderate availability issue. It is unlikely to justify emergency response without exposed archive-processing workflows, but internet-facing or business-critical file-ingestion services should be patched promptly to prevent avoidable crashes. Mitigation focus: Upgrade libarchive to 3.2.0 or a vendor-fixed package.; Apply relevant Red Hat, Oracle, Gentoo, or FreeBSD package guidance where applicable.; Restrict untrusted compressed-file processing until patched..

Prepared

Jun 13, 2026, 13:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.