CVE-2026-96596

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 29.0 through 29.1.1 stdlib versions 8.0 through 8.1.0 hex versions 2.4.2 through 2.5.2 hex core versions 0.14.0 through 0.20.0 rebar3 versions 3.27.1 and later

Description An infinite loop issue exists in the erl tar module (and its variants hex erl tar, mix hex erl tar, and r3 hex erl tar) when extracting tar archives. An attacker can cause a denial of service by providing a crafted GNU sparse member where the sparse map ends before the actual size of the member. During extraction, the erl tar:extract/1,2 function uses erl tar:stream to file loop/3 to read data in chunks. In affected versions, the erl tar:do sparse read/3 function matches a trailing-hole clause before a zero-length clause, leading to unbounded recursion that consumes a scheduler and keeps the process busy indefinitely. This can be triggered with an archive as small as 2048 bytes. The {max size, N} option only prevents this if N is smaller than the real size of the member. Extraction using the memory option is not affected.

Recommendations Update Erlang OTP to version 29.1.2 or later. Update stdlib to version 8.1.1 or later. Update hex to version 2.5.3 or later. Update hex core to version 0.20.1 or later. Update rebar3 to a version that incorporates the fix. As a temporary workaround, pass {chunks, N} and {max size, N} with the same value N to erl tar:extract/2 to ensure members larger than N are rejected and others are read in a single call. Alternatively, use the memory option for extraction and manually write the resulting files to disk.