Infinite Loop Vulnerability in Erlang OTP and Hexpm Libraries

CVE-2026-96596

What is CVE-2026-96596?

A vulnerability exists in Erlang's OTP stdlib and related Hexpm libraries, allowing an attacker to create a denial of service condition. By supplying a specially crafted tar archive, an infinite loop may occur during the extraction process, exhausting system resources. This affects multiple versions of Erlang OTP, stdlib, rebar3, and hex, where the extraction of GNU sparse members could cause the extraction process to recurse indefinitely without advancing, leading to potential system unresponsiveness. The impact is preventable with specific configurations, though the underlying issue persists across certain versions.

References