Riskcovery

CVE-2026-21619

Unsafe Deserialization of Erlang Terms in hex_core

State
Published
Severity
2.0 Low
Published
Feb 27, 2026
Updated
May 27, 2026
Reserved
Jan 1, 2026

Read the record on cve.org

Description

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4.

This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.

Scores

CVSSScoreVectorSource
4.02.0 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NEEF

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption
  • CWE-502 Deserialization of Untrusted Data

Affected Products

ProductVersions
hex_corehexpm
  • eb327f8edfe45507351e38cc0805aa12fa647f0b to before cdf726095bca85ad2549d146df1e831ae93c2b13Affected
hex_corehexpm
  • 0.1.0 to before 0.12.1Affected
hexhexpm
  • 314546ac432229518714cc8e3336e916b9da6305 to before 636739f3322514e9303ca335fb630696fcbb3c95Affected
hexhexpm
  • 2.3.0 to before 2.3.2Affected
rebar3erlang
  • 209c02ec57c2cc3207ee0174c3af3675b8dc8f79 to before 1d4478f527e373de0b225951e53115450e0d9b9dAffected
rebar3erlang
  • 3.9.1 to before 3.27.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.