CVE-2026-21619
published 2026-02-27CVE-2026-21619: Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.58%
43.1th percentile
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4.
This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | erlang-hex | < rebar3 3.27.0-1 (forky) | rebar3 3.27.0-1 (forky) |
| debian | rebar3 | < rebar3 3.27.0-1 (forky) | rebar3 3.27.0-1 (forky) |
| erlang | rebar3 | >= 0 < 3.27.0-1 | 3.27.0-1 |
| erlang | rebar3 | >= 209c02ec57c2cc3207ee0174c3af3675b8dc8f79 < 1d4478f527e373de0b225951e53115450e0d9b9d | 1d4478f527e373de0b225951e53115450e0d9b9d |
| erlang | rebar3 | >= 3.9.1 < 3.27.0 | 3.27.0 |
| hex | hex | >= 2.3.0 < 2.3.2 | 2.3.2 |
| hex | hex_core | >= 0 < 0.12.1 | 0.12.1 |
| hex | hex_core | >= 0.1.0 < 0.12.1 | 0.12.1 |
| hex | hex_core | >= 0.1.0 < 0.12.1 | 0.12.1 |
| hexpm | hex | >= 2.3.0 < 2.3.2 | 2.3.2 |
| hexpm | hex | >= 314546ac432229518714cc8e3336e916b9da6305 < 636739f3322514e9303ca335fb630696fcbb3c95 | 636739f3322514e9303ca335fb630696fcbb3c95 |
| hexpm | hex_core | >= 0.1.0 < 0.12.1 | 0.12.1 |
| hexpm | hex_core | >= eb327f8edfe45507351e38cc0805aa12fa647f0b < cdf726095bca85ad2549d146df1e831ae93c2b13 | cdf726095bca85ad2549d146df1e831ae93c2b13 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.02.0LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv2.0LOW
vendor_debian2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
hex_core has Unsafe Deserialization of Erlang Terms
ghsa·2026-03-01
CVE-2026-21619 [LOW] CWE-400 hex_core has Unsafe Deserialization of Erlang Terms
hex_core has Unsafe Deserialization of Erlang Terms
### Impact
The Hex client (`hex_core`) deserializes Erlang terms received from the Hex API using `binary_to_term/1` without sufficient restrictions.
If an attacker can control the HTTP response body returned by the Hex API, this allows denial-of-service attacks such as **atom table exhaustion**, leading to a VM crash. No released versions are known to allow remote code execution.
### Patches
* https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13
* https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95
* https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d
### Workarounds
Ensure that the Hex API URL (`HEX_API_URL`) points only to trusted endpoints. There
OSV
hex_core has Unsafe Deserialization of Erlang Terms
osv·2026-03-01
CVE-2026-21619 [LOW] hex_core has Unsafe Deserialization of Erlang Terms
hex_core has Unsafe Deserialization of Erlang Terms
### Impact
The Hex client (`hex_core`) deserializes Erlang terms received from the Hex API using `binary_to_term/1` without sufficient restrictions.
If an attacker can control the HTTP response body returned by the Hex API, this allows denial-of-service attacks such as **atom table exhaustion**, leading to a VM crash. No released versions are known to allow remote code execution.
### Patches
* https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13
* https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95
* https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d
### Workarounds
Ensure that the Hex API URL (`HEX_API_URL`) points only to trusted endpoints. There
OSV
CVE-2026-21619: Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules
osv·2026-02-27·CVSS 2.0
CVE-2026-21619 [LOW] CVE-2026-21619: Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
OSV
Unsafe Deserialization of Erlang Terms in hex_core
osv·2026-02-27·CVSS 2.0
CVE-2026-21619 [LOW] Unsafe Deserialization of Erlang Terms in hex_core
Unsafe Deserialization of Erlang Terms in hex_core
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4.
This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
Debian
CVE-2026-21619: erlang-hex - Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerabili...
vendor_debian·2026·CVSS 2.0
CVE-2026-21619 [LOW] CVE-2026-21619: erlang-hex - Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerabili...
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
Scope: local
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
https://cna.erlef.org/cves/CVE-2026-21619.htmlhttps://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9dhttps://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13https://github.com/hexpm/hex_core/security/advisories/GHSA-hx9w-f2w9-9g96https://osv.dev/vulnerability/EEF-CVE-2026-21619
2026-02-27
Published