11 matches found
CVE-2026-97200
Allocation of Resources Without Limits or Throttling vulnerability in hackneyconn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds...
EEF-CVE-2026-97200 Unbounded response body buffering and decompression in hackney
Summary Allocation of Resources Without Limits or Throttling vulnerability in hackneyconn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothin...
UBUNTU-CVE-2026-105274
Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...
SUSE CVE-2026-105274
Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...
CVE-2026-105274
Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...
CVE-2026-105274
Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...
EUVD-2026-97568
Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...
EEF-CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits
Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi...
CVE-2026-105274
Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...
PT-2026-110795
Name of the Vulnerable Software and Affected Versions rebar3 versions 3.9.1 through 3.27.2 hex versions 2.1.0 through 2.5.1 hex core versions 0.1.0 through 0.19.9 Description Improper handling of highly compressed data leads to a data amplification issue where an untrusted repository mirror or a...
CVE-2026-105274: Improper Handling of Highly Compressed Data (Data Amplification)
Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...