# CVE-2026-96596: Erlang OTP erl_tar infinite loop in GNU sparse member handling

Source: https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-96596 · Severity: info · Published 2026-10-14

Erlang's tar archive extraction module contains a flaw that causes an infinite loop when processing specially crafted GNU sparse tar members. An attacker can supply a malicious tar archive that will hang the extraction process indefinitely, consuming CPU resources and causing a denial of service. Even small 2 KB archives can tie up a system process until it is forcibly terminated.

Technologies: [Erlang OTP](https://junglewise.ai/threats/technologies/otp), [Hexpm Hex](https://junglewise.ai/threats/technologies/hexpm-hex), [Hexpm Hex Core](https://junglewise.ai/threats/technologies/hex-core). Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang), [Hexpm](https://junglewise.ai/threats/vendors/hexpm).

## Quick answers

**Is CVE-2026-96596 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96596 being exploited in the wild.

**How severe is CVE-2026-96596?** Informational severity, published 14 October 2026.

**Which products and versions are affected?** Erlang OTP 29.0 before 29.1.2; Erlang Rebar3 3.27.1 and later; Erlang Stdlib 8.0 before 8.1.1; Hexpm Hex 2.4.2 before 2.5.3; and 1 more.

**Is there a fix for CVE-2026-96596?** Yes: fixed in OTP 29.1.2 or later, stdlib 8.1.1 or later, hex_core 0.20.1 or later, Hex 2.5.3 or later. Until then: Use the memory option for tar extraction instead of disk-based extraction; restrict untrusted tar archive sources and validate archives before processing. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96596 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-96596?** Check whether you run Erlang OTP, Erlang Rebar3, Erlang Stdlib or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in OTP 29.1.2 or later, stdlib 8.1.1 or later, hex_core 0.20.1 or later, Hex 2.5.3 or later

Use the memory option for tar extraction instead of disk-based extraction; restrict untrusted tar archive sources and validate archives before processing.

## Technical details

The vulnerability exists in erl_tar:do_sparse_read/3, which handles GNU sparse tar members during extraction. When a sparse member's map ends before its declared real size, the function matches the trailing-hole clause instead of the zero-length clause, causing it to read zero bytes without advancing position and recurse infinitely. This affects OTP 29.0–29.1.1 stdlib, hex_core 0.14.0–0.20.0, rebar3 3.27.1+, and Hex 2.4.2–2.5.2; the {max_size, N} option only prevents the issue when N is below the member's real size, and memory-based extraction is unaffected.

## Affected products

- Erlang OTP 29.0 before 29.1.2
- Erlang stdlib 8.0 before 8.1.1
- hexpm hex_core 0.14.0 before 0.20.1
- hexpm Hex 2.4.2 before 2.5.3
- Erlang rebar3 3.27.1 and later

## Timeline

- 2026-10-14: disclosed

## Related threats

- [Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket](https://junglewise.ai/threats/cve-2026-94200-improper-validation-of-consistency-within-input-vulnerability-in)
- [hexpm hex_core memory exhaustion via compressed data amplification](https://junglewise.ai/threats/cve-2026-105274-improper-handling-of-highly-compressed-data-data-amplification)
- [Hex package manager data amplification via compressed responses](https://junglewise.ai/threats/cve-2026-96618-improper-handling-of-highly-compressed-data-data-amplification)
- [Hex path traversal in unvalidated dependency app names](https://junglewise.ai/threats/cve-2026-96612-improper-limitation-of-a-pathname-to-a-restricted-directory-path)
- [Hex terminal escape sequence injection via package metadata](https://junglewise.ai/threats/cve-2026-81856-improper-neutralization-of-escape-meta-or-control-sequences)