{"id":"CVE-2026-21619","aliases":["EEF-CVE-2026-21619","GHSA-hx9w-f2w9-9g96"],"url":"https://o3.security/vulnerability/CVE-2026-21619","summary":"Unsafe Deserialization of Erlang Terms in hex_core","details":"### Impact\n\nThe Hex client (`hex_core`) deserializes Erlang terms received from the Hex API using `binary_to_term/1` without sufficient restrictions.\n\nIf an attacker can control the HTTP response body returned by the Hex API, this allows denial-of-service attacks such as **atom table exhaustion**, leading to a VM crash. No released versions are known to allow remote code execution.\n\n### Patches\n\n* https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13\n* https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95\n* https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d\n\n### Workarounds\n\nEnsure that the Hex API URL (`HEX_API_URL`) points only to trusted endpoints. There is no client-side workaround that fully mitigates this issue without applying the patch.\n\n### Resources\n\n* hex_core Module: https://github.com/hexpm/hex_core/blob/main/src/hex_api.erl\n* Hex Vendored Module: https://github.com/hexpm/hex/blob/main/src/mix_hex_api.erl\n* Rebar3 Vendored Module: https://github.com/erlang/rebar3/blob/main/apps/rebar/src/vendored/r3_hex_api.erl\n* hex_core Patch: https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13\n* Hex Vendored Patch: https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95\n* Rebar3 Vendored Patch: https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d","published":"2026-02-27T17:57:11.513Z","modified":"2026-08-12T03:51:22.848385135Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Hex","name":"hex_core","fixedVersion":"0.12.1"}],"fix":{"url":"https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d","label":"erlang/rebar3@1d4478f"},"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-21619.html"},{"type":"WEB","url":"https://github.com"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-21619"},{"type":"WEB","url":"https://repo.hex.pm"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21619.json"},{"type":"ADVISORY","url":"https://github.com/hexpm/hex_core/security/advisories/GHSA-hx9w-f2w9-9g96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21619"},{"type":"FIX","url":"https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d"},{"type":"FIX","url":"https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95"},{"type":"FIX","url":"https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13"},{"type":"PACKAGE","url":"https://github.com/erlang/rebar3"},{"type":"PACKAGE","url":"https://github.com/hexpm/hex"},{"type":"PACKAGE","url":"https://github.com/hexpm/hex_core"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:22.848385135Z"}}