CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...

EUVD-2026-97568

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...

EEF-CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits

Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi...

CVE-2026-105274

The hexpm hex_core library, along with vendored components in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api), is vulnerable to a Data Amplification (CWE-409) attack. The vulnerability exists because hex_core decompresses registry responses using zlib:gunzip/1 and decodes Erl...

CVE-2026-96618

A flaw was found in hex. An untrusted package mirror can trigger a Denial of Service DoS by serving excessively large or highly compressed responses when fetching packages, documentation, or registry metadata. Because the client processes and decompresses incoming network data without enforcing...

CVE-2026-96612

A flaw was found in hex. This path traversal vulnerability allows a malicious package publisher to achieve arbitrary code execution and data loss. By specifying directory traversal sequences in a dependency application name, an attacker can manipulate the target directory outside the intended...

CVE-2026-81856

A flaw was found in hex. A remote attacker can inject unescaped terminal control sequences into the output of package manager commands by publishing a package with crafted metadata or serving hostile repository responses. When a user inspects package details, searches for packages, or views error...

CVE-2026-105668

A flaw was found in hex. This vulnerability allows an attacker with package owner privileges to bypass release-age cooldown security controls when publishing a new package release. By retiring an existing package release, the attacker triggers an automatic cooldown bypass, causing downstream...

CVE-2026-103503

A flaw was found in hex. When a custom Certificate Authority CA store is configured to restrict trusted authorities, hex inadvertently continues to validate certificate chains against its bundled CA certificates. An attacker capable of intercepting network traffic and holding a certificate issued...

CVE-2026-105280

A flaw was found in hex. This vulnerability allows a malicious package mirror to bypass integrity checks and substitute package files, which can lead to arbitrary code execution in downstream build pipelines. When downloading packages directly to standard output, hex fails to verify the archive's...

DEBIAN-CVE-2026-96618

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

DEBIAN-CVE-2026-96612

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-96618

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

CVE-2026-96612

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's...

DEBIAN-CVE-2026-81856

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository and the documentati...

CVE-2026-81856

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository and the documentati...

DEBIAN-CVE-2026-105668

Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown cooldown config, HEXCOOLDOWN withholds versions younger than the configured ag...

DEBIAN-CVE-2026-105280

Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signed regist...

DEBIAN-CVE-2026-103503

Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacertspath to a CA store that leaves that CA out...

CVE-2026-105280

Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signed regist...