What is CVE-2026-96596?

CVE-2026-96596 is erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole. The supplied enrichment data classifies it as Unclassified mapped to CWE-835 CWE-835.

Which versions are affected?

Affected product and version evidence is listed in the product table above. Current public advisories should be checked for exact version scope before patch targeting is finalized.

Is there active exploitation?

Active exploitation is not confirmed from current sources for CVE-2026-96596. If exploitation is not confirmed from current sources, teams should document that status and continue monitoring KEV, vendor, and telemetry updates.

No. CVE-2026-96596 is not listed in CISA KEV in the supplied enrichment data. KEV status should be monitored because it can change after initial disclosure or after exploitation becomes publicly confirmed.

Is there a public exploit?

A public PoC is not confirmed from current sources for CVE-2026-96596. Public exploit or PoC availability should raise triage priority, especially for exposed or business-critical systems.

How can defenders detect it?

Start with Not reported where available. Look for vulnerability-class behavior, product errors, suspicious authentication events, exploit probes, and abnormal process activity based only on evidence that applies to the affected product.

How should teams prioritize it?

Prioritize CVE-2026-96596 using CVSS 5.9, EPSS 0%, KEV status, public PoC status, and asset exposure. Internet-facing, privileged, or business-critical deployments should be handled first.

Are workarounds available?

The supplied mitigation guidance says to apply vendor patches and restrict external exposure until fixed. Fixed-version evidence is listed in the mitigation section above.

Which threat actors are linked publicly?

No public threat actor linkage is confirmed from current sources. Do not attribute exploitation to a threat actor unless the source evidence explicitly supports that linkage.

What should be done in the next 24 hours?

Identify exposed assets running affected vendor/product/version combinations. Prioritize based on EPSS, PoC availability, and external exposure. Search available logs for exploit probes, errors, authentication anomalies, or suspicious child processes matching the vulnerability class. Open remediation tickets with affected assets, owners, evidence status, and detection coverage so decisions are traceable.

medium

CVE-2026-96596

CVE-2026-96596 — erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member. When erl_tar:extract/1,2 writes a member to disk, erl_tar:stream_to_file_loop/3 reads it in chunks of 65536 bytes by default. For a GNU sparse member whose sparse map ends before its real size, erl_tar:do_sparse_read/3 matches its trailing-hole clause before its zero-length clause. After the chunk is used up, the trailing-hole clause reads zero bytes, does not advance the position, and recurses forever. A 2048-byte archive keeps the extracting process and one scheduler busy until the process is killed. The {max_size, N} option prevents this only when N is below the real size of the member. Extraction with the memory option is not affected. hex_core ships its own copy of erl_tar as hex_erl_tar, and Hex and rebar3 ship hex_core with prefixed module names (mix_hex_erl_tar and r3_hex_erl_tar). These copies contain the same code and do not call stdlib's erl_tar, so they are affected on any OTP version. OTP 28 is not affected, but an application running on OTP 28 is affected if it extracts archives through an affected version of hex_core, Hex or rebar3. This issue affects OTP from OTP 29.0 before OTP 29.1.2, corresponding to stdlib from 8.0 before 8.1.1, and rebar3 from 3.27.1 onward, and hex from 2.4.2 onward; hex_core: from 0.14.0 onward.

Published Oct 14, 2026Updated Oct 14, 2026Sources: NVD, Erlang (CNA), GitHub, SOCRadar CTI

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

ahead of 0% of scored CVEs

Affects

Erlang

9 products listed

CVSS base

5.9

medium

Remediation

The vendor's own words where we have them.

Upgrade OTP to a fixed release. Apply vendor patches per advisory and restrict external exposure of the affected component until patched.

First 24 hours

Ordered from the record's own fields — exposure first, because you cannot patch what you have not found.

Identify exposed assets running affected vendor/product/version combinations.
Prioritize based on EPSS, PoC availability, and external exposure.
Search available logs for exploit probes, errors, authentication anomalies, or suspicious child processes matching the vulnerability class.

Affected scope

Vendor, product and version as the advisories word them.

Vendor	Product	Versions	Status
Erlang	OTP	29.0 to < 29.1.2	Vulnerable
Erlang	OTP	8.0 to < 8.1.1	Vulnerable
Erlang	OTP	fbf2c7194f6fce4b7b66dc0bcaa4f6b4b85e088f to < 3086307f311b78b38644a7787a3aca6a3f95a9d5	Vulnerable
erlang	rebar3	3.27.1	Vulnerable
erlang	rebar3	23dbdb5d1f87f56902aef296c88a20049cd0c6e4	Vulnerable
hexpm	hex	2.4.2	Vulnerable
hexpm	hex	5543a1919c709d8eb2b317f62aad76ca1eed375c	Vulnerable
hexpm	hex_core	0.14.0	Vulnerable
hexpm	hex_core	13bb9fbba418a406af614790b8d5cd458259ee70	Vulnerable

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Scope

Attack Complexity

Low

Attack Vector

Local

Privileges Req

None

User Interaction

None

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Source
5.9	CVSS 4.0	medium	—	—	Erlang (CNA)

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What this weakness leads to

MITRE's own consequences and mitigations for the weakness class — the authority's wording, not guidance derived from the CVSS vector.

MITRE

CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')

DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
DoS: Amplification

Weakness & attack patterns

CWE-835

Detection

Read off the CVSS vector and the weakness class. Starting points, not rules we have tested.

Search application, proxy, and WAF logs for requests touching /1,2, /3.

Timeline

What happened to this CVE, newest first — with the readings a source repeats on a schedule counted underneath rather than listed.

2026
Added · CVSS 3.1 5.9 (AV:L)
Oct 14, 2026 · NVD
Initial · CVE published
Oct 14, 2026 · NVD
CVE published by MITRE.
Oct 14, 2026 · SOCRadar CTI

References

10 on the record

cna.erlef.org/cves/CVE-2026-96596.html
Vendor Advisory, Mitre, NIST
github.com/erlang/otp/commit/3086307f311b78b38644a7787a3aca6a3f95a9d5
Exploit, Third Party Advisory, Mitre, NIST
github.com/erlang/otp/commit/fbf2c7194f6fce4b7b66dc0bcaa4f6b4b85e088f
Exploit, Third Party Advisory, Mitre, NIST
github.com/erlang/otp/security/advisories/GHSA-phm5-m6cj-5382
Exploit, Third Party Advisory, Mitre, NIST
github.com/erlang/rebar3/commit/23dbdb5d1f87f56902aef296c88a20049cd0c6e4
Exploit, Third Party Advisory, Mitre, NIST
github.com/hexpm/hex/commit/5543a1919c709d8eb2b317f62aad76ca1eed375c
Exploit, Third Party Advisory, Mitre, NIST
github.com/hexpm/hex_core/commit/13bb9fbba418a406af614790b8d5cd458259ee70
Exploit, Third Party Advisory, Mitre, NIST
osv.dev/vulnerability/EEF-CVE-2026-96596
Vendor Advisory, Mitre, NIST

Elsewhere on this site

Erlangevery CVE for this vendor
erlangevery CVE for this vendor
hexpmevery CVE for this vendor
Unclassifiedsame class
CWE-835other pages naming this weakness

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record1

What should defenders know first?

CVE-2026-96596 is erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole, a medium vulnerability affecting OTP, rebar3, hex, hex_core from Erlang, erlang, hexpm. The current evidence does not list it in CISA KEV, and the exploit status is: Active exploitation is not confirmed from current sources for CVE-2026-96596. Public exploit evidence is: A public PoC is not confirmed from current sources for CVE-2026-96596. The affected-version evidence is listed in the key facts and affected products tables. Defenders should first verify whether exposed or business-critical assets run those versions, then apply vendor patches or mitigations, restrict reachable attack surface, and preserve logs for detection review. CVSS 5.9 describes technical severity, while EPSS 0% helps estimate near-term exploit likelihood; neither replaces asset context. Unknown fields should remain explicit in tickets, and threat actor, IOC, victimology, or payload claims should not be added unless a cited source supports them. Monitor CISA KEV, vendor advisories, NVD changes, public PoC repositories, and internal telemetry for update triggers.