Read the docs
TI-2026-19283 Aliases CVE-2026-23940

Denial of Service via Oversized Package Upload

Priority LOW 38CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality. This issue affects hex.pm: before 2026-03-10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00467 40th percentileScored 2026-11-07
Fix Fixed hexpm (hexpm): 2026-03-10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hexpmhexpmbefore 2026-03-102026-03-10Patch availableCNA
  • hexpm Vendorhexpm Affected before 2026-03-10 Fixed in 2026-03-10 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hex:hexpm:*:*:*:*:*:*:*:*before 2026-03-09Vulnerablehexpm
  • cpe:2.3:a:hex:hexpm:*:*:*:*:*:*:*:* Versions before 2026-03-09 Vulnerable ·hexpm

Remediation

  • Fix · CNA hexpm (hexpm) Fixed in 2026-03-10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23940

References

Patch 1

Advisory 1

Other 3

  • TI-2026-17414 Password Reset Tokens Do Not Expire CVSS 4.0CRITICAL 9.5
  • TI-2026-17410 Cross-site scripting (XSS) in OAuth Device Authorization screen CVSS 4.0HIGH 8.5
  • TI-2026-19282 Path Traversal in Local File Store Backend CVSS 4.0MEDIUM 6.9
  • TI-2026-17413 Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences