Vulnerability · CVE-2026-96596
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
Published Oct 14, 2026 · catalog updated Oct 15, 2026 · Erlang OTP
Check if you run it
No confirmed exploitation is on record for CVE-2026-96596. EPSS is 0.18%. Act only if a listed version of Erlang OTP is installed.
Gaps on this record
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium5.9
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.18%
- Remediation
- Advisory link
- Affected products
- Hex hex_core · vendor Erlang OTP · vendor erlang rebar3 · vendor hexpm hex · vendor hexpm hex_core
## Summary Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib ( module), hexpm hex_core ( module), hexpm hex ( module) and erlang rebar3 ( module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member. When writes a member to disk, reads it in chunks of 65536 bytes by default. For a GNU sparse member whose sparse map ends before its real size, matches its trailing-hole clause before its zero-length clause. After the chunk is used up, the trailing-hole clause reads zero bytes, does not advance the position, and recurses forever. A 2048-byte archive keeps the extracting process and one scheduler busy until the process is killed. The option prevents this only when N is below the real size of the member. Extraction with the option is not affected. hex_core ships its own copy of as , and Hex and rebar3 ship hex_core with prefixed module names ( and ). These copies contain the same code and do not call stdlib's , so they are affected on any OTP version. OTP 28 is not affected, but an application running on OTP 28 is affected if it extracts archives through an affected version of hex_core, Hex or rebar3. This issue affects OTP from OTP 29.0 before OTP 29.1.2, corresponding to stdlib from 8.0 before 8.1.1, and rebar3 from 3.27.1 onward, and hex from 2.4.2 before 2.5.3; hex_core: from 0.14.0 before 0.20.1. ## Details **1. Chunked extraction.** writes each member to disk through . This function calls until the field of the reader is 0. The default chunk size is 65536 bytes. **2. Clause order in .** For a sparse member, calls . The clause for a trailing hole matches when is and . It comes before the clause that returns when is 0. **3. Unbounded recursion.** The member is a GNU sparse member (typeflag ) whose real size is larger than one chunk and whose sparse map ends before the real size. After the data fragments, the trailing-hole clause reads the rest of the chunk and recurses with .
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Hex hex_core0.14.0 → 0.20.1
- vendor Erlang OTPversion unspecified
- vendor erlang rebar3version unspecified
- vendor hexpm hexversion unspecified
- vendor hexpm hex_coreversion unspecified
How to fix CVE-2026-96596
Recommended remediation
A patch or advisory reference is linked. Open the original publisher for availability by product version.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-96596. EPSS is 0.18%. Act only if a listed version of Erlang OTP is installed.
Which versions are affected?
Compare what you have installed with 0.14.0 → 0.20.1. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-835: Infinite Loop. EPSS 0.18%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member. When erl_tar:extract/1,2 writes a member to disk, erl_tar:stream_to_fi
Oct 14, 2026 · GitHub Advisory Database
Fix available
hex_core fixed in 0.20.1
Oct 14, 2026 · NIST NVD
Updated
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member. When erl_tar:extract/1,2 writes a member to disk, erl_tar:stream_to_fi
Oct 15, 2026 · GitHub Advisory Database
Fix available
hex_core fixed in 0.20.1
Oct 15, 2026 · NIST NVD
Updated
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member. When erl_tar:extract/1,2 writes a member to disk, erl_tar:stream_to_fi
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-96596
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a d
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-96596
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-96596
30-day exploitation probability 0.2%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-phm5-m6cj-5382
GitHub Advisory Database record mirrored by OSV.
github.com - NIST NVDVulnerability recordCVE-2026-96596
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a d
nvd.nist.gov - OpenSSF OSV / OSV ScannerPackage advisoryEEF-CVE-2026-96596
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
osv.dev
References
Freshness
Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.