Vulnerability EEF-CVE-2026-21619
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
7 months ago
February 27, 2026 at 05:57 PM UTC
Unsafe Deserialization of Erlang Terms in hex_core
0.1.0 - 0.12.0
0.1.0 - 0.12.0
Summary
Unsafe Deserialization of Erlang Terms in hex_core
Details
Summary
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4.
This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
3 hours ago
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
0.1.0 - 0.19.0 EEF-CVE-2026-103502
0.1.0 - 0.19.0 EEF-CVE-2026-103502
Low Risk
7 months ago
hex_core has Unsafe Deserialization of Erlang Terms
0.1.0 - 0.12.0 GHSA-hx9w-f2w9-9g96
0.1.0 - 0.12.0 GHSA-hx9w-f2w9-9g96
High Risk
4 years ago
Hex authenticity of signed packages not validated
0.1.0 - 0.3.0 GHSA-q3cc-rr2c-87r6
0.1.0 - 0.3.0 GHSA-q3cc-rr2c-87r6
Impacted packages
Timeline
Published
7 months ago
February 27, 2026 at 05:57 PM UTC
Fixed (0.12.1)
7 months ago
February 27, 2026 at 04:16 PM UTC
Last Modified
2 months ago
July 30, 2026 at 06:21 PM UTC