hex_core
Hex5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting hex_corepage 1 of 1
- CVE-2019-1000013HIGHCVSS 8.8EG 8.8fixed in 0.4.02019-02-04
vulnerable: 0.1.0, 0.1.1, 0.2.0, 0.2.1, 0.3.0
Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be explo…
- CVE-2026-103502MEDIUMCVSS 5.9EG 5.90.20.0 (the fix for one version range)2026-10-12
vulnerable: 0.1.0 ... 0.9.0 (44 versions)
Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core's default HTTP ad…
- CVE-2026-105274LOWCVSS 2.1EG 2.10.20.0 (the fix for one version range)2026-10-12
vulnerable: 0.1.0 ... 0.9.0 (44 versions)
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core.…
- CVE-2026-21619HIGHCVSS 7.5EG 7.5fixed in 0.12.12026-02-27
vulnerable: 0.1.0 ... 0.9.0 (33 versions)
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This…
- CVE-2026-96596MEDIUMCVSS 5.9EG 5.90.20.1 (the fix for one version range)2026-10-14
vulnerable: 0.14.0 ... 0.20.0 (9 versions)
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacke…
Check whether hex_core is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for hex_core CVEs against the assets you own.
Book a Demo →