FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Erlang/OTP -- erl_tar denial of service via crafted GNU sparse member

Affected packages
		erlang-runtime29	<	29.1.2

Details

VuXML ID	37492489-c8f9-11f1-9ceb-4c526214c986
Discovery	2026-10-14
Entry	2026-10-16

https://github.com/erlang/otp/security/advisories/GHSA-phm5-m6cj-5382 reports:

A loop with unreachable exit condition ('infinite loop') vulnerability in the erl_tar module allowed an attacker who supplied a tar archive to cause a denial of service via a crafted GNU sparse member with a trailing hole.

[source]

References

CVE Name	CVE-2026-96596
URL	https://github.com/erlang/otp/releases/tag/OTP-29.1.2
URL	https://github.com/erlang/otp/security/advisories/GHSA-phm5-m6cj-5382