CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits

[
  {
    "cpes": [
      "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "r3_hex_repo",
      "r3_hex_api"
    ],
    "packageName": "rebar3",
    "packageURL": "pkg:otp/rebar3?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Frebar3&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Frebar3.git",
    "product": "rebar3",
    "programFiles": [
      "apps/rebar/src/vendored/r3_hex_repo.erl",
      "apps/rebar/src/vendored/r3_hex_api.erl"
    ],
    "programRoutines": [
      {
        "name": "r3_hex_repo:get_names/1"
      },
      {
        "name": "r3_hex_repo:get_versions/1"
      },
      {
        "name": "r3_hex_repo:get_package/2"
      },
      {
        "name": "r3_hex_api:request/4"
      }
    ],
    "repo": "https://github.com/erlang/rebar3",
    "vendor": "erlang",
    "versions": [
      {
        "lessThan": "3.27.3",
        "status": "affected",
        "version": "3.9.1",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "r3_hex_repo",
      "r3_hex_api"
    ],
    "packageName": "erlang/rebar3",
    "packageURL": "pkg:github/erlang/rebar3",
    "product": "rebar3",
    "programFiles": [
      "apps/rebar/src/vendored/r3_hex_repo.erl",
      "apps/rebar/src/vendored/r3_hex_api.erl"
    ],
    "programRoutines": [
      {
        "name": "r3_hex_repo:get_names/1"
      },
      {
        "name": "r3_hex_repo:get_versions/1"
      },
      {
        "name": "r3_hex_repo:get_package/2"
      },
      {
        "name": "r3_hex_api:request/4"
      }
    ],
    "repo": "https://github.com/erlang/rebar3",
    "vendor": "erlang",
    "versions": [
      {
        "lessThan": "360838a22f5b3a88c0358207f2923059bcbb3afb",
        "status": "affected",
        "version": "209c02ec57c2cc3207ee0174c3af3675b8dc8f79",
        "versionType": "git"
      }
    ]
  },
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "hex_repo",
      "hex_api",
      "hex_safe_binary_to_term"
    ],
    "packageName": "hex_core",
    "packageURL": "pkg:hex/hex_core",
    "product": "hex_core",
    "programFiles": [
      "src/hex_repo.erl",
      "src/hex_api.erl",
      "src/hex_safe_binary_to_term.erl"
    ],
    "programRoutines": [
      {
        "name": "hex_repo:get_names/1"
      },
      {
        "name": "hex_repo:get_versions/1"
      },
      {
        "name": "hex_repo:get_package/2"
      },
      {
        "name": "hex_repo:get_policy/2"
      },
      {
        "name": "hex_api:request/4"
      },
      {
        "name": "hex_safe_binary_to_term:safe_binary_to_term/1"
      }
    ],
    "repo": "https://github.com/hexpm/hex_core",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "0.20.0",
        "status": "affected",
        "version": "0.1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "hex_repo",
      "hex_api",
      "hex_safe_binary_to_term"
    ],
    "packageName": "hexpm/hex_core",
    "packageURL": "pkg:github/hexpm/hex_core",
    "product": "hex_core",
    "programFiles": [
      "src/hex_repo.erl",
      "src/hex_api.erl",
      "src/hex_safe_binary_to_term.erl"
    ],
    "programRoutines": [
      {
        "name": "hex_repo:get_names/1"
      },
      {
        "name": "hex_repo:get_versions/1"
      },
      {
        "name": "hex_repo:get_package/2"
      },
      {
        "name": "hex_repo:get_policy/2"
      },
      {
        "name": "hex_api:request/4"
      },
      {
        "name": "hex_safe_binary_to_term:safe_binary_to_term/1"
      }
    ],
    "repo": "https://github.com/hexpm/hex_core",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "ebe25d110717f6a3addba5232cd4a7dc1c76b628",
        "status": "affected",
        "version": "fbb6d9de472e5edb8d6fb6b32a91cb266137892e",
        "versionType": "git"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "mix_hex_repo",
      "mix_hex_api"
    ],
    "packageName": "hex",
    "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git",
    "product": "hex",
    "programFiles": [
      "src/mix_hex_repo.erl",
      "src/mix_hex_api.erl"
    ],
    "programRoutines": [
      {
        "name": "mix_hex_repo:get_names/1"
      },
      {
        "name": "mix_hex_repo:get_versions/1"
      },
      {
        "name": "mix_hex_repo:get_package/2"
      },
      {
        "name": "mix_hex_repo:get_policy/2"
      },
      {
        "name": "mix_hex_api:request/4"
      }
    ],
    "repo": "https://github.com/hexpm/hex",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "2.5.2",
        "status": "affected",
        "version": "2.1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "mix_hex_repo",
      "mix_hex_api"
    ],
    "packageName": "hexpm/hex",
    "packageURL": "pkg:github/hexpm/hex",
    "product": "hex",
    "programFiles": [
      "src/mix_hex_repo.erl",
      "src/mix_hex_api.erl"
    ],
    "programRoutines": [
      {
        "name": "mix_hex_repo:get_names/1"
      },
      {
        "name": "mix_hex_repo:get_versions/1"
      },
      {
        "name": "mix_hex_repo:get_package/2"
      },
      {
        "name": "mix_hex_repo:get_policy/2"
      },
      {
        "name": "mix_hex_api:request/4"
      }
    ],
    "repo": "https://github.com/hexpm/hex",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "d8b60eee97abb119d525306f048969a217d793a5",
        "status": "affected",
        "version": "671f695ac548ed01f5828c2a739ecaa942b21007",
        "versionType": "git"
      }
    ]
  }
]