{"id":"CVE-2026-96596","revision":"3e3fade38fae428f8bdedfe06d51696c","records":[{"revision":"3e3fade38fae428f8bdedfe06d51696c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-96596","aliases":[],"title":"erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole","description":"Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member.\n\nWhen erl_tar:extract/1,2 writes a member to disk, erl_tar:stream_to_file_loop/3 reads it in chunks of 65536 bytes by default. For a GNU sparse member whose sparse map ends before its real size, erl_tar:do_sparse_read/3 matches its trailing-hole clause before its zero-length clause. After the chunk is used up, the trailing-hole clause reads zero bytes, does not advance the position, and recurses forever. A 2048-byte archive keeps the extracting process and one scheduler busy until the process is killed. The {max_size, N} option prevents this only when N is below the real size of the member. Extraction with the memory option is not affected.\n\nhex_core ships its own copy of erl_tar as hex_erl_tar, and Hex and rebar3 ship hex_core with prefixed module names (mix_hex_erl_tar and r3_hex_erl_tar). These copies contain the same code and do not call stdlib's erl_tar, so they are affected on any OTP version. OTP 28 is not affected, but an application running on OTP 28 is affected if it extracts archives through an affected version of hex_core, Hex or rebar3.\n\nThis issue affects OTP from OTP\u00A029.0 before OTP\u00A029.1.2, corresponding to rebar3 from 3.27.1 before 3.28.0, and stdlib from 8.0 before 8.1.1, and hex from 2.4.2 before 2.5.3; hex_core: from 0.14.0 before 0.20.1.","state":0,"publishedAt":"2026-10-14T16:56:18.53+00:00","modifiedAt":"2026-10-22T07:08:09.364+00:00","affected":[{"ecosystem":"Vendor product","name":"rebar3","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"cpes\": [\n                        \"cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"r3_hex_erl_tar\",\n                        \"r3_hex_tarball\"\n                    ],\n                    \"packageName\": \"rebar3\",\n                    \"packageURL\": \"pkg:otp/rebar3?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Frebar3&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Frebar3.git\",\n                    \"product\": \"rebar3\",\n                    \"programFiles\": [\n                        \"apps/rebar/src/vendored/r3_hex_erl_tar.erl\",\n                        \"apps/rebar/src/vendored/r3_hex_tarball.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"r3_hex_erl_tar:do_sparse_read/3\"\n                        },\n                        {\n                            \"name\": \"r3_hex_erl_tar:stream_to_file_loop/3\"\n                        },\n                        {\n                            \"name\": \"r3_hex_erl_tar:extract/1\"\n                        },\n                        {\n                            \"name\": \"r3_hex_erl_tar:extract/2\"\n                        },\n                        {\n                            \"name\": \"r3_hex_tarball:unpack/2\"\n                        },\n                        {\n                            \"name\": \"r3_hex_tarball:unpack/3\"\n                        },\n                        {\n                            \"name\": \"r3_hex_tarball:unpack_docs/2\"\n                        },\n                        {\n                            \"name\": \"r3_hex_tarball:unpack_docs/3\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/erlang/rebar3\",\n                    \"vendor\": \"erlang\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"3.28.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.27.1\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://github.com","name":"erlang/rebar3","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://github.com\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"r3_hex_erl_tar\",\n                        \"r3_hex_tarball\"\n                    ],\n                    \"packageName\": \"erlang/rebar3\",\n                    \"packageURL\": \"pkg:github/erlang/rebar3\",\n                    \"product\": \"rebar3\",\n                    \"programFiles\": [\n                        \"apps/rebar/src/vendored/r3_hex_erl_tar.erl\",\n                        \"apps/rebar/src/vendored/r3_hex_tarball.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"r3_hex_erl_tar:do_sparse_read/3\"\n                        },\n                        {\n                            \"name\": \"r3_hex_erl_tar:stream_to_file_loop/3\"\n                        },\n                        {\n                            \"name\": \"r3_hex_erl_tar:extract/1\"\n                        },\n                        {\n                            \"name\": \"r3_hex_erl_tar:extract/2\"\n                        },\n                        {\n                            \"name\": \"r3_hex_tarball:unpack/2\"\n                        },\n                        {\n                            \"name\": \"r3_hex_tarball:unpack/3\"\n                        },\n                        {\n                            \"name\": \"r3_hex_tarball:unpack_docs/2\"\n                        },\n                        {\n                            \"name\": \"r3_hex_tarball:unpack_docs/3\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/erlang/rebar3\",\n                    \"vendor\": \"erlang\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"310e2ec8c7dd3df05d67af2b7fae23f30fc523c4\",\n                            \"status\": \"affected\",\n                            \"version\": \"23dbdb5d1f87f56902aef296c88a20049cd0c6e4\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://repo.hex.pm","name":"hex_core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://repo.hex.pm\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"hex_erl_tar\",\n                        \"hex_tarball\"\n                    ],\n                    \"packageName\": \"hex_core\",\n                    \"packageURL\": \"pkg:hex/hex_core\",\n                    \"product\": \"hex_core\",\n                    \"programFiles\": [\n                        \"src/hex_erl_tar.erl\",\n                        \"src/hex_tarball.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"hex_erl_tar:do_sparse_read/3\"\n                        },\n                        {\n                            \"name\": \"hex_erl_tar:stream_to_file_loop/3\"\n                        },\n                        {\n                            \"name\": \"hex_erl_tar:extract/1\"\n                        },\n                        {\n                            \"name\": \"hex_erl_tar:extract/2\"\n                        },\n                        {\n                            \"name\": \"hex_tarball:unpack/2\"\n                        },\n                        {\n                            \"name\": \"hex_tarball:unpack/3\"\n                        },\n                        {\n                            \"name\": \"hex_tarball:unpack_docs/2\"\n                        },\n                        {\n                            \"name\": \"hex_tarball:unpack_docs/3\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/hexpm/hex_core\",\n                    \"vendor\": \"hexpm\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"0.20.1\",\n                            \"status\": \"affected\",\n                            \"version\": \"0.14.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://github.com","name":"hexpm/hex_core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://github.com\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"hex_erl_tar\",\n                        \"hex_tarball\"\n                    ],\n                    \"packageName\": \"hexpm/hex_core\",\n                    \"packageURL\": \"pkg:github/hexpm/hex_core\",\n                    \"product\": \"hex_core\",\n                    \"programFiles\": [\n                        \"src/hex_erl_tar.erl\",\n                        \"src/hex_tarball.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"hex_erl_tar:do_sparse_read/3\"\n                        },\n                        {\n                            \"name\": \"hex_erl_tar:stream_to_file_loop/3\"\n                        },\n                        {\n                            \"name\": \"hex_erl_tar:extract/1\"\n                        },\n                        {\n                            \"name\": \"hex_erl_tar:extract/2\"\n                        },\n                        {\n                            \"name\": \"hex_tarball:unpack/2\"\n                        },\n                        {\n                            \"name\": \"hex_tarball:unpack/3\"\n                        },\n                        {\n                            \"name\": \"hex_tarball:unpack_docs/2\"\n                        },\n                        {\n                            \"name\": \"hex_tarball:unpack_docs/3\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/hexpm/hex_core\",\n                    \"vendor\": \"hexpm\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"a2ece683e6e88a3ec95ad20b09aca426e08b372e\",\n                            \"status\": \"affected\",\n                            \"version\": \"13bb9fbba418a406af614790b8d5cd458259ee70\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"otp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"cpes\": [\n                        \"cpe:2.3:a:erlang:erlang\\\\/otp:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"erl_tar\"\n                    ],\n                    \"packageName\": \"otp\",\n                    \"packageURL\": \"pkg:software-id/erlang.org/otp\",\n                    \"product\": \"OTP\",\n                    \"programFiles\": [\n                        \"lib/stdlib/src/erl_tar.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"erl_tar:do_sparse_read/3\"\n                        },\n                        {\n                            \"name\": \"erl_tar:stream_to_file_loop/3\"\n                        },\n                        {\n                            \"name\": \"erl_tar:extract/1\"\n                        },\n                        {\n                            \"name\": \"erl_tar:extract/2\"\n                        }\n                    ],\n                    \"vendor\": \"Erlang\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"29.1.2\",\n                            \"status\": \"affected\",\n                            \"version\": \"29.0\",\n                            \"versionType\": \"otp\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"stdlib","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"cpes\": [\n                        \"cpe:2.3:a:erlang:erlang\\\\/otp:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"erl_tar\"\n                    ],\n                    \"packageName\": \"stdlib\",\n                    \"packageURL\": \"pkg:otp/stdlib?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git\",\n                    \"product\": \"OTP\",\n                    \"programFiles\": [\n                        \"src/erl_tar.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"erl_tar:do_sparse_read/3\"\n                        },\n                        {\n                            \"name\": \"erl_tar:stream_to_file_loop/3\"\n                        },\n                        {\n                            \"name\": \"erl_tar:extract/1\"\n                        },\n                        {\n                            \"name\": \"erl_tar:extract/2\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/erlang/otp\",\n                    \"vendor\": \"Erlang\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"8.1.1\",\n                            \"status\": \"affected\",\n                            \"version\": \"8.0\",\n                            \"versionType\": \"otp\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://github.com","name":"erlang/otp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://github.com\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:erlang:erlang\\\\/otp:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"erl_tar\"\n                    ],\n                    \"packageName\": \"erlang/otp\",\n                    \"packageURL\": \"pkg:github/erlang/otp\",\n                    \"product\": \"OTP\",\n                    \"programFiles\": [\n                        \"lib/stdlib/src/erl_tar.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"erl_tar:do_sparse_read/3\"\n                        },\n                        {\n                            \"name\": \"erl_tar:stream_to_file_loop/3\"\n                        },\n                        {\n                            \"name\": \"erl_tar:extract/1\"\n                        },\n                        {\n                            \"name\": \"erl_tar:extract/2\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/erlang/otp\",\n                    \"vendor\": \"Erlang\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"3086307f311b78b38644a7787a3aca6a3f95a9d5\",\n                            \"status\": \"affected\",\n                            \"version\": \"fbf2c7194f6fce4b7b66dc0bcaa4f6b4b85e088f\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"hex","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"cpes\": [\n                        \"cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"mix_hex_erl_tar\",\n                        \"mix_hex_tarball\"\n                    ],\n                    \"packageName\": \"hex\",\n                    \"packageURL\": \"pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git\",\n                    \"product\": \"hex\",\n                    \"programFiles\": [\n                        \"src/mix_hex_erl_tar.erl\",\n                        \"src/mix_hex_tarball.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"mix_hex_erl_tar:do_sparse_read/3\"\n                        },\n                        {\n                            \"name\": \"mix_hex_erl_tar:stream_to_file_loop/3\"\n                        },\n                        {\n                            \"name\": \"mix_hex_erl_tar:extract/1\"\n                        },\n                        {\n                            \"name\": \"mix_hex_erl_tar:extract/2\"\n                        },\n                        {\n                            \"name\": \"mix_hex_tarball:unpack/2\"\n                        },\n                        {\n                            \"name\": \"mix_hex_tarball:unpack/3\"\n                        },\n                        {\n                            \"name\": \"mix_hex_tarball:unpack_docs/2\"\n                        },\n                        {\n                            \"name\": \"mix_hex_tarball:unpack_docs/3\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/hexpm/hex\",\n                    \"vendor\": \"hexpm\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"2.5.3\",\n                            \"status\": \"affected\",\n                            \"version\": \"2.4.2\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://github.com","name":"hexpm/hex","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://github.com\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"mix_hex_erl_tar\",\n                        \"mix_hex_tarball\"\n                    ],\n                    \"packageName\": \"hexpm/hex\",\n                    \"packageURL\": \"pkg:github/hexpm/hex\",\n                    \"product\": \"hex\",\n                    \"programFiles\": [\n                        \"src/mix_hex_erl_tar.erl\",\n                        \"src/mix_hex_tarball.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"mix_hex_erl_tar:do_sparse_read/3\"\n                        },\n                        {\n                            \"name\": \"mix_hex_erl_tar:stream_to_file_loop/3\"\n                        },\n                        {\n                            \"name\": \"mix_hex_erl_tar:extract/1\"\n                        },\n                        {\n                            \"name\": \"mix_hex_erl_tar:extract/2\"\n                        },\n                        {\n                            \"name\": \"mix_hex_tarball:unpack/2\"\n                        },\n                        {\n                            \"name\": \"mix_hex_tarball:unpack/3\"\n                        },\n                        {\n                            \"name\": \"mix_hex_tarball:unpack_docs/2\"\n                        },\n                        {\n                            \"name\": \"mix_hex_tarball:unpack_docs/3\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/hexpm/hex\",\n                    \"vendor\": \"hexpm\",\n                    \"versions\": [\n                        {\n                            \"changes\": [\n                                {\n                                    \"at\": \"8e1067131a13949eff30623f31648a945ffd5418\",\n                                    \"status\": \"unaffected\"\n                                },\n                                {\n                                    \"at\": \"7847c23d09ab52113614c3718e1e7d368743da5d\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"lessThan\": \"*\",\n                            \"status\": \"affected\",\n                            \"version\": \"5543a1919c709d8eb2b317f62aad76ca1eed375c\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":5.9,"severity":"MEDIUM"}],"references":["https://github.com/erlang/otp/security/advisories/GHSA-phm5-m6cj-5382","https://cna.erlef.org/cves/CVE-2026-96596.html","https://osv.dev/vulnerability/EEF-CVE-2026-96596","https://www.erlang.org/doc/system/versions.html#order-of-versions","https://github.com/erlang/rebar3/commit/23dbdb5d1f87f56902aef296c88a20049cd0c6e4","https://github.com/erlang/rebar3/commit/310e2ec8c7dd3df05d67af2b7fae23f30fc523c4","https://github.com/hexpm/hex_core/commit/13bb9fbba418a406af614790b8d5cd458259ee70","https://github.com/hexpm/hex_core/commit/a2ece683e6e88a3ec95ad20b09aca426e08b372e","https://github.com/erlang/otp/commit/fbf2c7194f6fce4b7b66dc0bcaa4f6b4b85e088f","https://github.com/erlang/otp/commit/3086307f311b78b38644a7787a3aca6a3f95a9d5","https://github.com/hexpm/hex/commit/5543a1919c709d8eb2b317f62aad76ca1eed375c","https://github.com/hexpm/hex/commit/8e1067131a13949eff30623f31648a945ffd5418","https://github.com/hexpm/hex/commit/7847c23d09ab52113614c3718e1e7d368743da5d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96596","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-96596","identifiers":["CVE-2026-96596"]},"retained":false,"historicalAffected":[]}],"coverage":[]}