CVE-2026-96596Published
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-96596 · Microsoft / collected KEV context
cve-program · CVE-2026-96596
- https://github.com/erlang/otp/security/advisories/GHSA-phm5-m6cj-5382
- https://cna.erlef.org/cves/CVE-2026-96596.html
- https://osv.dev/vulnerability/EEF-CVE-2026-96596
- https://www.erlang.org/doc/system/versions.html#order-of-versions
- https://github.com/erlang/rebar3/commit/23dbdb5d1f87f56902aef296c88a20049cd0c6e4
- https://github.com/erlang/rebar3/commit/310e2ec8c7dd3df05d67af2b7fae23f30fc523c4
- https://github.com/hexpm/hex_core/commit/13bb9fbba418a406af614790b8d5cd458259ee70
- https://github.com/hexpm/hex_core/commit/a2ece683e6e88a3ec95ad20b09aca426e08b372e
- https://github.com/erlang/otp/commit/fbf2c7194f6fce4b7b66dc0bcaa4f6b4b85e088f
- https://github.com/erlang/otp/commit/3086307f311b78b38644a7787a3aca6a3f95a9d5
- https://github.com/hexpm/hex/commit/5543a1919c709d8eb2b317f62aad76ca1eed375c
- https://github.com/hexpm/hex/commit/8e1067131a13949eff30623f31648a945ffd5418
- https://github.com/hexpm/hex/commit/7847c23d09ab52113614c3718e1e7d368743da5d
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.