Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: hexpm hex_core 0.20.0 Clear all filters
TI-2026-71203 CVE-2026-105274

Unbounded decompression in hex_core exhausts Erlang VM memory

Priority LOW 12

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang V…

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00447 Published 2026-10-12 Fixed in 3.27.3, 0.20.0 +1 CWE-409
TI-2026-70975 CVE-2026-103502 · GHSA-5rf8-f3v4-rg98

hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

Priority LOW 26

Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_cor…

CVSS 4.0MEDIUM 5.9 Network No auth User interaction EPSS 0.00242 Published 2026-10-12 Fixed in 0.20.0 CWE-295