CVE-2026-21619 Unsafe Deserialization of Erlang Terms in hex_core

[
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "hex_api"
    ],
    "packageName": "hexpm/hex_core",
    "packageURL": "pkg:github/hexpm/hex_core",
    "product": "hex_core",
    "programFiles": [
      "src/hex_api.erl"
    ],
    "programRoutines": [
      {
        "name": "hex_core:request/4"
      }
    ],
    "repo": "https://github.com/hexpm/hex_core",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "cdf726095bca85ad2549d146df1e831ae93c2b13",
        "status": "affected",
        "version": "eb327f8edfe45507351e38cc0805aa12fa647f0b",
        "versionType": "git"
      }
    ]
  },
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "hex_api"
    ],
    "packageName": "hex_core",
    "packageURL": "pkg:hex/hex_core",
    "product": "hex_core",
    "programFiles": [
      "src/hex_api.erl"
    ],
    "programRoutines": [
      {
        "name": "hex_core:request/4"
      }
    ],
    "repo": "https://github.com/hexpm/hex_core",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "0.12.1",
        "status": "affected",
        "version": "0.1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "mix_hex_api"
    ],
    "packageName": "hexpm/hex",
    "packageURL": "pkg:github/hexpm/hex",
    "product": "hex",
    "programFiles": [
      "src/mix_hex_api.erl"
    ],
    "programRoutines": [
      {
        "name": "mix_hex_api:request/4"
      }
    ],
    "repo": "https://github.com/hexpm/hex",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "636739f3322514e9303ca335fb630696fcbb3c95",
        "status": "affected",
        "version": "314546ac432229518714cc8e3336e916b9da6305",
        "versionType": "git"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "mix_hex_api"
    ],
    "packageName": "hex",
    "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex.git&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git",
    "product": "hex",
    "programFiles": [
      "src/mix_hex_api.erl"
    ],
    "programRoutines": [
      {
        "name": "mix_hex_api:request/4"
      }
    ],
    "repo": "https://github.com/hexpm/hex",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "2.3.2",
        "status": "affected",
        "version": "2.3.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "r3_hex_api"
    ],
    "packageName": "erlang/rebar3",
    "packageURL": "pkg:github/erlang/rebar3",
    "product": "rebar3",
    "programFiles": [
      "apps/rebar/src/vendored/r3_hex_api.erl"
    ],
    "programRoutines": [
      {
        "name": "r3_hex_api:request/4"
      }
    ],
    "repo": "https://github.com/erlang/rebar3",
    "vendor": "erlang",
    "versions": [
      {
        "lessThan": "1d4478f527e373de0b225951e53115450e0d9b9d",
        "status": "affected",
        "version": "209c02ec57c2cc3207ee0174c3af3675b8dc8f79",
        "versionType": "git"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "r3_hex_api"
    ],
    "packageName": "rebar3",
    "packageURL": "pkg:otp/rebar3?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Frebar3.git&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Frebar3.git",
    "product": "rebar3",
    "programFiles": [
      "apps/rebar/src/vendored/r3_hex_api.erl"
    ],
    "programRoutines": [
      {
        "name": "r3_hex_api:request/4"
      }
    ],
    "repo": "https://github.com/erlang/rebar3",
    "vendor": "erlang",
    "versions": [
      {
        "lessThan": "3.27.0",
        "status": "affected",
        "version": "3.9.1",
        "versionType": "semver"
      }
    ]
  }
]