hexpm hex core vulnerabilities

Latest hexpm hex core CVEs

Newest publication first

1. CVE-2026-96596 erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

   Published 2026-10-14

   Medium·CVSS 5.9 EPSS 0.21%

   Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a d...

2. CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits

   Published 2026-10-12

   Low·CVSS 2.1 EPSS 0.45%

   Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_he...

3. CVE-2026-103502 hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

   Published 2026-10-12

   Medium·CVSS 5.9 EPSS 0.24%

   Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when...

4. CVE-2026-21619 Unsafe Deserialization of Erlang Terms in hex_core

   Published 2026-02-27

   Low·CVSS 2.0 EPSS 0.64%

   Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.