hex_core
0.21.1
Reference implementation of Hex specifications
Current section
5 Advisories
Jump to
Current section
5 Advisories
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-96596.html
- https://github.com/erlang/otp/commit/3086307f311b78b38644a7787a3aca6a3f95a9d5
- https://github.com/erlang/otp/commit/fbf2c7194f6fce4b7b66dc0bcaa4f6b4b85e088f
- https://github.com/erlang/otp/security/advisories/GHSA-phm5-m6cj-5382
- https://github.com/erlang/rebar3/commit/23dbdb5d1f87f56902aef296c88a20049cd0c6e4
- https://github.com/erlang/rebar3/commit/310e2ec8c7dd3df05d67af2b7fae23f30fc523c4
- https://github.com/hexpm/hex/commit/5543a1919c709d8eb2b317f62aad76ca1eed375c
- https://github.com/hexpm/hex/commit/7847c23d09ab52113614c3718e1e7d368743da5d
- https://github.com/hexpm/hex/commit/8e1067131a13949eff30623f31648a945ffd5418
- https://github.com/hexpm/hex_core/commit/13bb9fbba418a406af614790b8d5cd458259ee70
- https://github.com/hexpm/hex_core/commit/a2ece683e6e88a3ec95ad20b09aca426e08b372e
- https://hex.pm/packages/hex_core
- https://www.erlang.org/doc/system/versions.html#order-of-versions
hex_core decompresses registry and Erlang term API responses without size limits
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-105274.html
- https://github.com/erlang/rebar3/commit/209c02ec57c2cc3207ee0174c3af3675b8dc8f79
- https://github.com/erlang/rebar3/commit/360838a22f5b3a88c0358207f2923059bcbb3afb
- https://github.com/hexpm/hex/commit/671f695ac548ed01f5828c2a739ecaa942b21007
- https://github.com/hexpm/hex/commit/d8b60eee97abb119d525306f048969a217d793a5
- https://github.com/hexpm/hex_core/commit/ebe25d110717f6a3addba5232cd4a7dc1c76b628
- https://github.com/hexpm/hex_core/commit/fbb6d9de472e5edb8d6fb6b32a91cb266137892e
- https://github.com/hexpm/hex_core/security/advisories/GHSA-7c4r-cgf9-9jmq
- https://hex.pm/packages/hex_core
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-103502.html
- https://github.com/hexpm/hex_core/commit/b7b3a42defb4ed8e20a5c68a4412ce68a95b7938
- https://github.com/hexpm/hex_core/commit/fbb6d9de472e5edb8d6fb6b32a91cb266137892e
- https://github.com/hexpm/hex_core/security/advisories/GHSA-p26c-h8c2-rwqj
- https://hex.pm/packages/hex_core
Unsafe Deserialization of Erlang Terms in hex_core
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-21619.html
- https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d
- https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95
- https://github.com/hexpm/hex_core
- https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13
- https://github.com/hexpm/hex_core/security/advisories/GHSA-hx9w-f2w9-9g96
- https://hex.pm/packages/hex_core
- https://nvd.nist.gov/vuln/detail/CVE-2026-21619
- https://osv.dev/vulnerability/EEF-CVE-2026-21619
Hex authenticity of signed packages not validated
Affected Versions
Checksum
Dependency Config
mix.exs
rebar.config
Gleam
erlang.mk
Package Details
this version
127
yesterday
29 271
last 7 days
163 787
all time
52 509 411
Last Updated
Oct 22, 2026
License
Apache-2.0
Build Tools
Provenance
- Source Commit
- github.com/hexpm/hex_core@d366662
- Build File
- .github/workflows/release.yml
- Branch
- main
- Environment
- release
- Triggered By
- ericmj on push
