TI-2026-74335 Aliases CVE-2026-96596

Infinite loop in erl_tar extraction of crafted GNU sparse members

LOW 26CWE-835Published 2026-10-14 · Updated 2026-10-22

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-835.

Summary

The erl_tar module in Erlang OTP stdlib and its copies in hex_core, Hex and rebar3 loop forever on a GNU sparse tar member whose sparse map ends before its real size (CWE-835). An attacker who supplies a crafted tar archive can keep the extracting process busy until it is killed, causing denial of service. Affected ranges: OTP from 29.0 before 29.1.2, stdlib from 8.0 before 8.1.1, rebar3 from 3.27.1 before 3.28.0, hex from 2.4.2 before 2.5.3 and hex_core from 0.14.0 before 0.20.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member. When erl_tar:extract/1,2 writes a member to disk, erl_tar:stream_to_file_loop/3 reads it in chunks of 65536 bytes by default. For a GNU sparse member whose sparse map ends before its real size, erl_tar:do_sparse_read/3 matches its trailing-hole clause before its zero-length clause. After the chunk is used up, the trailing-hole clause reads zero bytes, does not advance the position, and recurses forever. A 2048-byte archive keeps the extracting process and one scheduler busy until the process is killed. The {max_size, N} option prevents this only when N is below the real size of the member. Extraction with the memory option is not affected. hex_core ships its own copy of erl_tar as hex_erl_tar, and Hex and rebar3 ship hex_core with prefixed module names (mix_hex_erl_tar and r3_hex_erl_tar). These copies contain the same code and do not call stdlib's erl_tar, so they are affected on any OTP version. OTP 28 is not affected, but an application running on OTP 28 is affected if it extracts archives through an affected version of hex_core, Hex or rebar3. This issue affects OTP from OTP 29.0 before OTP 29.1.2, corresponding to rebar3 from 3.27.1 before 3.28.0, and stdlib from 8.0 before 8.1.1, and hex from 2.4.2 before 2.5.3; hex_core: from 0.14.0 before 0.20.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00213 11th percentileScored 2026-11-07

Fix Fixed rebar3 (erlang): 3.28.0hex_core (hexpm): 0.20.1+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Erlang	rebar3	3.27.1 to before 3.28.0	3.28.0	Patch available	CNA
hexpm	hex_core	0.14.0 to before 0.20.1	0.20.1	Patch available	CNA
Erlang	OTP	29.0 to before 29.1.2	29.1.2	Patch available	CNA
Erlang	OTP	8.0 to before 8.1.1	8.1.1	Patch available	CNA
hexpm	hex	2.4.2 to before 2.5.3	2.5.3	Patch available	CNA

rebar3 VendorErlang Affected 3.27.1 to before 3.28.0 Fixed in 3.28.0 Patch available CNA
hex_core Vendorhexpm Affected 0.14.0 to before 0.20.1 Fixed in 0.20.1 Patch available CNA
OTP VendorErlang Affected 29.0 to before 29.1.2 Fixed in 29.1.2 Patch available CNA
OTP VendorErlang Affected 8.0 to before 8.1.1 Fixed in 8.1.1 Patch available CNA
hex Vendorhexpm Affected 2.4.2 to before 2.5.3 Fixed in 2.5.3 Patch available CNA

CPE names CNA · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:erlang:rebar3::::::::	—	—	Erlang
cpe:2.3:a:hexpm:hex_core::::::::	—	—	—
cpe:2.3:a:erlang:erlang\/otp::::::::	—	—	Erlang
cpe:2.3:a:hexpm:hex::::::::	—	—	—

cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:* Versions — — ·Erlang
cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:* Versions — — ·—
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* Versions — — ·Erlang
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fixed versions are OTP 29.1.2, stdlib 8.1.1, rebar3 3.28.0, hex 2.5.3 and hex_core 0.20.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA rebar3 (erlang) Fixed in 3.28.0
Fix · CNA hex_core (hexpm) Fixed in 0.20.1
Fix · CNA OTP (Erlang) Fixed in 29.1.2
Fix · CNA OTP (Erlang) Fixed in 8.1.1
Fix · CNA hex (hexpm) Fixed in 2.5.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-15 Threatist record created from CVE-2026-96596
2026-10-16 Priority changed: MEDIUM → LOW
2026-10-16 Affected versions changed · Red Hat
2026-10-16 CVSS score added · Red Hat
2026-10-18 CISA SSVC decision points changed
2026-10-20 Fix available: erlang/rebar3@310e2ec8c7dd3df05d67af2b7fae23f30fc523c4 · CNA
2026-10-20 1 new reference · CNA
2026-10-22 Fix available: [email protected] · CNA

References

Patch 5

Advisory 1

GitHub Advisory

Other 7

TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
TI-2026-48954 httpd parks a request worker indefinitely on a malformed chunk size sent after the headers CVSS 4.0HIGH 8.7
TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
TI-2026-71037 Path traversal in rebar3 via unvalidated dependency app names CVSS 4.0HIGH 7.5
TI-2024-36042 ssl fails to validate incorrect extened key usage CVSS 3.1MEDIUM 5.5
TI-2020-10791 Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL… CVSS 3.1CRITICAL 9.8

See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences