CVE-2026-21619lowCWE-400CWE-502

CVE-2026-21619: falha de baixa gravidade em hexpm hex

Unsafe Deserialization of Erlang Terms in hex_core

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar hexpm+ Monitorar rebar3

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2epss 0.6%
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
erlang · rebar3hexpm · hexhexpm · hex_core
CVEs relacionadas — hexpm hex

No mesmo produto, das mais perigosas para as menos.

CVE-2026-103060HIGHPath traversal in rebar3 via unvalidated dependency app namesEPSS 0.5%CVE-2026-105274LOWhex_core decompresses registry and Erlang term API responses without size limitsEPSS 0.4%CVE-2026-96612HIGHPath traversal in Hex via unvalidated dependency app namesEPSS 0.4%CVE-2026-81856LOWTerminal escape sequence injection in Hex via unneutralized server-supplied outputEPSS 0.4%CVE-2026-105668HIGHHex release-age cooldown is lifted package-wide when the locked release is retiredEPSS 0.4%CVE-2026-96618LOWHex exhausts memory and disk on oversized or compressed responses from an untrusted mirrorEPSS 0.4%