CVE-2026-96596: Erlang OTP erl_tar infinite loop in GNU sparse member handling

CVE-2026-96596 · Severity: info · Published 2026-10-14

Erlang's tar archive extraction module contains a flaw that causes an infinite loop when processing specially crafted GNU sparse tar members. An attacker can supply a malicious tar archive that will hang the extraction process indefinitely, consuming CPU resources and causing a denial of service. Even small 2 KB archives can tie up a system process until it is forcibly terminated.

Technologies: Erlang OTP, Hexpm Hex, Hexpm Hex Core. Vendors: Erlang, Hexpm.

Quick answers

Is CVE-2026-96596 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-96596 being exploited in the wild.
How severe is CVE-2026-96596?
Informational severity, published 14 October 2026.
Which products and versions are affected?
Erlang OTP 29.0 before 29.1.2; Erlang Rebar3 3.27.1 and later; Erlang Stdlib 8.0 before 8.1.1; Hexpm Hex 2.4.2 before 2.5.3; and 1 more.
Is there a fix for CVE-2026-96596?
Yes: fixed in OTP 29.1.2 or later, stdlib 8.1.1 or later, hex_core 0.20.1 or later, Hex 2.5.3 or later. Until then: Use the memory option for tar extraction instead of disk-based extraction; restrict untrusted tar archive sources and validate archives before processing. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96596 attacked?
It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-96596?
Check whether you run Erlang OTP, Erlang Rebar3, Erlang Stdlib or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: OTP 29.1.2 or later, stdlib 8.1.1 or later, hex_core 0.20.1 or later, Hex 2.5.3 or later

Use the memory option for tar extraction instead of disk-based extraction; restrict untrusted tar archive sources and validate archives before processing.

Technical details

The vulnerability exists in erl_tar:do_sparse_read/3, which handles GNU sparse tar members during extraction. When a sparse member's map ends before its declared real size, the function matches the trailing-hole clause instead of the zero-length clause, causing it to read zero bytes without advancing position and recurse infinitely. This affects OTP 29.0–29.1.1 stdlib, hex_core 0.14.0–0.20.0, rebar3 3.27.1+, and Hex 2.4.2–2.5.2; the {max_size, N} option only prevents the issue when N is below the member's real size, and memory-based extraction is unaffected.

Affected products

  • Erlang OTP 29.0 before 29.1.2
  • Erlang stdlib 8.0 before 8.1.1
  • hexpm hex_core 0.14.0 before 0.20.1
  • hexpm Hex 2.4.2 before 2.5.3
  • Erlang rebar3 3.27.1 and later

Timeline

  • 2026-10-14: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.