CVE-2026-96596: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') in Erlang OTP

This vulnerability involves an infinite loop in the Erlang OTP stdlib erl_tar module and its copies in hexpm hex_core, hex, and rebar3 when extracting tar archives containing a crafted GNU sparse member. The function erl_tar:stream_to_file_loop/3 reads data in chunks, but for certain sparse maps, the trailing-hole clause reads zero bytes repeatedly without advancing the read position, causing a recursive infinite loop. This leads to a denial of service by consuming CPU resources until the process is killed. The issue affects OTP versions >=29.0 and <29.1.2, stdlib versions >=8.0 and <8.1.1, rebar3 versions >=3.27.1, hex versions >=2.4.2, and hex_core versions >=0.14.0. OTP 28 is not affected unless using vulnerable versions of hex_core, hex, or rebar3. The {max_size, N} option can mitigate the issue only if N is less than the real size of the member. Extraction using the memory option is not affected.

An attacker who supplies a specially crafted tar archive can cause the extraction process to enter an infinite loop, resulting in denial of service by exhausting CPU resources on the affected system. This affects applications that extract tar archives using the vulnerable erl_tar module or its copies in hex_core, hex, or rebar3. The impact is limited to denial of service; there is no indication of code execution or data corruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a temporary mitigation, avoid extracting tar archives from untrusted sources or use the extraction memory option, which is not affected by this vulnerability. The {max_size, N} option can help prevent the issue only if N is set below the real size of the sparse member. Monitor vendor advisories for official patches or updates.