Read the docs
TI-2026-71203 Aliases CVE-2026-105274

Unbounded decompression in hex_core exhausts Erlang VM memory

Priority LOW 12CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Hex, hex_core and rebar3 decompress repository and API responses without size limits (CWE-409). Affected versions are rebar3 from 3.9.1 before 3.27.3, hex from 2.1.0 before 2.5.2 and hex_core from 0.1.0 before 0.20.0. An untrusted repository mirror or API server sends a small compressed response that expands into a huge term, exhausting the Erlang VM memory. The signature check runs only after decoding, so the memory use happens before any rejection.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api). hex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it. hex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:safe_binary_to_term/1, which calls binary_to_term(Binary, [safe]). The safe option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the safe option and that check without bounding the decoded size. This issue affects rebar3: from 3.9.1 before 3.27.3; hex: from 2.1.0 before 2.5.2; hex_core: from 0.1.0 before 0.20.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00447 39th percentileScored 2026-11-07
Fix Fixed rebar3 (erlang): 3.27.3hex_core (hexpm): 0.20.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Erlangrebar33.9.1 to before 3.27.33.27.3Patch availableCNA
hexpmhex_core0.1.0 to before 0.20.00.20.0Patch availableCNA
hexpmhex2.1.0 to before 2.5.22.5.2Patch availableCNA
  • rebar3 VendorErlang Affected 3.9.1 to before 3.27.3 Fixed in 3.27.3 Patch available CNA
  • hex_core Vendorhexpm Affected 0.1.0 to before 0.20.0 Fixed in 0.20.0 Patch available CNA
  • hex Vendorhexpm Affected 2.1.0 to before 2.5.2 Fixed in 2.5.2 Patch available CNA

CPE names CNA · 3

CPEVersionsRoleVendor
cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*——Erlang
cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*———
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:* Versions — — ·Erlang
  • cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:* Versions — — ·—
  • cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade rebar3 to 3.27.3, hex to 2.5.2 and hex_core to 0.20.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA rebar3 (erlang) Fixed in 3.27.3
  • Fix · CNA hex_core (hexpm) Fixed in 0.20.0
  • Fix · CNA hex (hexpm) Fixed in 2.5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    hexpm hex 2.5.2

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-71017 Path traversal in Hex via unvalidated dependency app namesPriority LOW 35
    • TI-2026-71021 Hex release-age cooldown is lifted when a locked release is retiredPriority LOW 33
    • TI-2026-71020 Hex mix hex.package fetch writes unverified tarballs to stdoutPriority LOW 30
    Show all 7 records →
  • Release ·

    hexpm hex_core 0.20.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-70975 hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25Priority LOW 26
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-105274
  2. 2026-10-12 Fix available: erlang/rebar3@360838a22f5b3a88c0358207f2923059bcbb3afb, [email protected] · CNA
  3. 2026-10-12 1 new reference · CNA
  4. 2026-10-13 Affected versions changed · Red Hat
  5. 2026-10-13 CVSS score added · Red Hat
  6. 2026-10-16 CISA SSVC decision points changed

References

Patch 3

Advisory 1

Other 5

  • TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-48954 httpd parks a request worker indefinitely on a malformed chunk size sent after the headers CVSS 4.0HIGH 8.7
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2026-71037 Path traversal in rebar3 via unvalidated dependency app names CVSS 4.0HIGH 7.5
  • TI-2024-36042 ssl fails to validate incorrect extened key usage CVSS 3.1MEDIUM 5.5
  • TI-2020-10791 Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL… CVSS 3.1CRITICAL 9.8
See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences