CVE-2026-96596: OTP 29.0 to before 29.1.2, 8.0 to before 8.1.1; +3 more affected products

Affected technology

OTP · 29.0 to before 29.1.2
Erlang

OTP · 8.0 to before 8.1.1
Erlang

OTP · fbf2c7194f6fce4b7b66dc0bcaa4f6b4b85e088f to before 3086307f311b78b38644a7787a3aca6a3f95a9d5
Erlang

rebar3 · 3.27.1 to before *
erlang

rebar3 · 23dbdb5d1f87f56902aef296c88a20049cd0c6e4 to before *
erlang

hex_core · 0.14.0 to before 0.20.1
hexpm

hex_core · 13bb9fbba418a406af614790b8d5cd458259ee70 to before a2ece683e6e88a3ec95ad20b09aca426e08b372e
hexpm

hex · 2.4.2 to before 2.5.3
hexpm

hex · 5543a1919c709d8eb2b317f62aad76ca1eed375c to before *; status changes: 8e1067131a13949eff30623f31648a945ffd5418 — unaffected, 7847c23d09ab52113614c3718e1e7d368743da5d — unaffected
hexpm

Component: erl_tar, r3_hex_erl_tar, r3_hex_tarball, hex_erl_tar, hex_tarball, mix_hex_erl_tar, mix_hex_tarball
Function: erl_tar:do_sparse_read/3, erl_tar:stream_to_file_loop/3, erl_tar:extract/1, erl_tar:extract/2, r3_hex_erl_tar:do_sparse_read/3, r3_hex_erl_tar:stream_to_file_loop/3, r3_hex_erl_tar:extract/1, r3_hex_erl_tar:extract/2, r3_hex_tarball:unpack/2, r3_hex_tarball:unpack/3, r3_hex_tarball:unpack_docs/2, r3_hex_tarball:unpack_docs/3, hex_erl_tar:do_sparse_read/3, hex_erl_tar:stream_to_file_loop/3, hex_erl_tar:extract/1, hex_erl_tar:extract/2, hex_tarball:unpack/2, hex_tarball:unpack/3, hex_tarball:unpack_docs/2, hex_tarball:unpack_docs/3, mix_hex_erl_tar:do_sparse_read/3, mix_hex_erl_tar:stream_to_file_loop/3, mix_hex_erl_tar:extract/1, mix_hex_erl_tar:extract/2, mix_hex_tarball:unpack/2, mix_hex_tarball:unpack/3, mix_hex_tarball:unpack_docs/2, mix_hex_tarball:unpack_docs/3
File: lib/stdlib/src/erl_tar.erl, src/erl_tar.erl, apps/rebar/src/vendored/r3_hex_erl_tar.erl, apps/rebar/src/vendored/r3_hex_tarball.erl, src/hex_erl_tar.erl, src/hex_tarball.erl, src/mix_hex_erl_tar.erl, src/mix_hex_tarball.erl

Attack conditions (Source advisory, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service under the conditions described by the source. Source advisory’s CVSS 4.0 assessment (base score 5.9/10) rates confidentiality and integrity impact as none; availability impact as high.