CVE-2026-103503

Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacertspath to a CA store that leaves that CA out...

CVE-2026-103503

The hexpm hex tool (versions 0.20.2 before 2.5.2 ) is vulnerable to Improper Certificate Validation (CWE-295 ). The root cause is that Hex.HTTP.SSL.partial_chain/2 uses a bundled CA store to build the partial chain callback regardless of whether a custom cacerts_path (HEX_CACERTS_PATH) is provide...

CVE-2026-103503 Hex trusts its bundled CA certificates when cacerts_path is set

Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacertspath to a CA store that leaves that CA out...