CVE-2026-96596: 
Erlang OTP vulnerability analysis and mitigation

CVE-2026-96596 is an infinite loop (CWE-835) vulnerability in Erlang/OTP's erl_tar module and its vendored copies in hex_core, hex, and rebar3 that allows an attacker supplying a crafted tar archive to cause a denial of service. The flaw was disclosed on October 14, 2026, and affects Erlang/OTP stdlib versions 8.0–8.1.0 (OTP 29.0–29.1.1), hexpm hex_core 0.14.0–0.20.0, hexpm hex 2.4.2–2.5.2, and erlang rebar3 3.27.1. OTP 28 itself is not affected, but applications on OTP 28 that use an affected version of hex_core, Hex, or rebar3 remain vulnerable. It carries a CVSS v4.0 base score of 5.9 (Medium) (GitHub Advisory, Feedly).

The root cause (CWE-835) lies in the pattern-matching order within erl_tar:do_sparse_read/3. When extracting a GNU sparse tar member to disk, stream_to_file_loop/3 reads data in 65,536-byte chunks. For a sparse member whose sparse map ends before the member's declared real size (a trailing hole), the trailing-hole clause is matched before the zero-length termination clause. After consuming the current chunk, the trailing-hole clause calls read_sparse_hole/3 with the full Offset as the length argument instead of the remaining Len, reads zero bytes, does not advance the file position, and recurses indefinitely. A crafted archive as small as 2,048 bytes is sufficient to trigger the loop, keeping the extracting Erlang process and one scheduler permanently busy. The {max_size, N} option only prevents the loop when N is smaller than the member's declared real size; extraction using the memory option is not affected. Because hex_core, hex, and rebar3 vendor their own copies of erl_tar (as hex_erl_tar, mix_hex_erl_tar, and r3_hex_erl_tar respectively) and do not call stdlib's erl_tar, they carry the same bug independently of the OTP version in use (GitHub Advisory, OTP Fix Commit).

Successful exploitation causes the targeted Erlang process and one BEAM scheduler to spin indefinitely until the process is killed, resulting in a denial of service. Because a single BEAM scheduler is monopolized, overall throughput of the affected node degrades proportionally to the number of schedulers consumed. There is no confidentiality or integrity impact; the vulnerability is limited to availability of the affected process and scheduler (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires that an attacker be able to supply a crafted tar archive to a system that extracts it using an affected code path (disk extraction, not memory extraction), which is an attack requirement (AT:P in CVSS v4.0). The CVE status is "Received" and it has not been added to the CISA Known Exploited Vulnerabilities catalog. No EPSS score or threat actor attribution is currently available (GitHub Advisory, Feedly).

1. Craft the malicious archive: Construct a GNU sparse tar archive (≥2,048 bytes) containing a member whose sparse map declares data only at offset 0 (e.g., 4 bytes), but whose realsize field is set to a large value (e.g., 1 MiB). This creates a trailing hole that extends beyond the sparse map's last entry.
2. Deliver the archive: Supply the crafted archive to a target system that processes tar archives using an affected erl_tar code path — for example, a Hex package server, a CI/CD pipeline running rebar3 or mix, or any Elixir/Erlang application that calls erl_tar:extract/1,2 with disk output.
3. Trigger extraction: Cause the target to invoke erl_tar:extract/2 (or the equivalent vendored function in hex_core/hex/rebar3) with the {cwd, Dir} option (disk extraction). The memory option is not affected.
4. Infinite loop achieved: do_sparse_read/3 matches the trailing-hole clause, reads zero bytes, fails to advance the position, and recurses forever. The extracting process and one BEAM scheduler are permanently busy, degrading node availability until the process is killed or the node is restarted (GitHub Advisory, OTP Fix Commit).

• Process: An Erlang process stuck indefinitely in erl_tar:do_sparse_read/3 or erl_tar:stream_to_file_loop/3 (or their vendored equivalents r3_hex_erl_tar, mix_hex_erl_tar, hex_erl_tar); observable via erlang:process_info(Pid, current_function) returning one of these functions continuously.
• Scheduler: One BEAM scheduler running at 100% CPU utilization for an extended period without completing work; detectable via :observer, recon, or OS-level CPU monitoring.
• Logs: Application logs showing a tar extraction operation that never completes or times out; absence of a completion log entry after initiating extraction of a package or archive.
• File System: A partially written output file in the extraction directory that does not grow in size despite ongoing CPU usage, indicating the write loop is not advancing.

Patches: Upgrade to Erlang/OTP 29.1.2 (stdlib 8.1.1), hexpm hex_core 0.20.1, hexpm hex 2.5.3, or a rebar3 version that vendors hex_core 0.20.1 or later. The fix reorders the zero-length termination clause before the trailing-hole clause in do_sparse_read/3 and corrects the read_sparse_hole call to pass Len instead of Offset (OTP Fix Commit, hex Release).

Workarounds (if patching is not immediately possible):

• Pass {chunks, N} together with {max_size, N} using the same value N to erl_tar:extract/2. This causes extraction to reject any member larger than N and read each remaining member in a single call, preventing the infinite loop.
• Alternatively, extract archives using the memory option and write the returned binaries to disk in application code — the memory extraction path is not affected by this bug (GitHub Advisory).

The vulnerability was discovered and responsibly disclosed by Eric Meadows-Jönsson, who also provided the remediation patch. The Erlang/OTP security advisory credits him as both reporter and fix contributor. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (GitHub Advisory).