CVE-2026-105274 - Vulnerability Details

- hex_core decompresses registry and Erlang term API responses without size limits

Description

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api).

hex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it.

hex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:safe_binary_to_term/1, which calls binary_to_term(Binary, [safe]). The safe option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the safe option and that check without bounding the decoded size.

This issue affects rebar3: from 3.9.1 before 3.27.3; hex: from 2.1.0 before 2.5.2; hex_core: from 0.1.0 before 0.20.0.

Published: 2026-10-12

Score: 2.1 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

hex_core, Hex, and rebar3 allow an attacker controlling an untrusted repository mirror or an API server to send a highly compressed payload that expands into a large binary inside the Erlang VM. The code decompresses registry or Erlang term responses before signature verification and without size limits. As a result, the decompressed data can consume the available memory, leading to a denial‑of‑service that may exhaust the process or system resources.

Affected Systems

Erlang rebar3 from 3.9.1 before 3.27.3, Hex from 2.1.0 before 2.5.2, and hex_core from 0.1.0 before 0.20.0 are affected. The vendors are Erlang for rebar3 and hexpm for both Hex and hex_core. The fix is in hex_core 0.20.0, which is incorporated into Hex 2.5.2.

Risk and Exploitability

The CVSS score is 2.1, indicating low severity. No EPSS data is available, and the vulnerability is not in the CISA KEV catalog. The attack vector is primarily through an untrusted or malicious mirror or API server that a user can host or compromise. While random exploitation is unlikely, organizations that rely on third‑party mirrors or consume packages from unknown sources should consider the risk of a resource exhaustion attack and implement safeguards.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

erlang

rebar3

unaffected

Version	Status	Constraints
`3.9.1`	affected	< 3.27.3

erlang

rebar3

unaffected

Version	Status	Constraints
`209c02ec57c2cc3207ee0174c3af3675b8dc8f79`	affected	< 360838a22f5b3a88c0358207f2923059bcbb3afb

hexpm

hex_core

unaffected

Version	Status	Constraints
`0.1.0`	affected	< 0.20.0

hexpm

hex_core

unaffected

Version	Status	Constraints
`fbb6d9de472e5edb8d6fb6b32a91cb266137892e`	affected	< ebe25d110717f6a3addba5232cd4a7dc1c76b628

hexpm

hex

unaffected

Version	Status	Constraints
`2.1.0`	affected	< 2.5.2

hexpm

hex

unaffected

Version	Status	Constraints
`671f695ac548ed01f5828c2a739ecaa942b21007`	affected	< d8b60eee97abb119d525306f048969a217d793a5

No data.

Vendor Product Confidence Versions

Erlang

Rebar3

95%

Version	Status	Scheme	Platform
`[3.9.1,3.27.3)`	affected	semver	—
`[209c02ec57c2cc3207ee0174c3af3675b8dc8f79,360838a22f5b3a88c0358207f2923059bcbb3afb)`	affected	code_commit	—

Erlang

Rebar3

100%

Version	Status	Scheme	Platform
`[209c02ec57c2cc3207ee0174c3af3675b8dc8f79,360838a22f5b3a88c0358207f2923059bcbb3afb)`	affected	code_commit	—

Hexpm

Hex

95%

Version	Status	Scheme	Platform
`[2.1.0,2.5.2)`	affected	semver	—
`[671f695ac548ed01f5828c2a739ecaa942b21007,d8b60eee97abb119d525306f048969a217d793a5)`	affected	code_commit	—

Hexpm

Hex

100%

Version	Status	Scheme	Platform
`[671f695ac548ed01f5828c2a739ecaa942b21007,d8b60eee97abb119d525306f048969a217d793a5)`	affected	code_commit	—

Hexpm

Hex Core

95%

Version	Status	Scheme	Platform
`[0.1.0,0.20.0)`	affected	semver	—
`[fbb6d9de472e5edb8d6fb6b32a91cb266137892e,ebe25d110717f6a3addba5232cd4a7dc1c76b628)`	affected	code_commit	—

Hexpm

Hex Core

100%

Version	Status	Scheme	Platform
`[fbb6d9de472e5edb8d6fb6b32a91cb266137892e,ebe25d110717f6a3addba5232cd4a7dc1c76b628)`	affected	code_commit	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Solution

Upgrade hex_core to 0.20.0 or later. Registry resources larger than 16 MiB after decompression are rejected with {too_big_uncompressed, MaxSize}, configurable with registry_max_uncompressed_size. Upgrade Hex to 2.5.2 or later, which vendors hex_core 0.20.0. No rebar3 release vendors hex_core 0.20.0 yet.

Vendor Workaround

Point repository URLs at repo.hex.pm or a mirror you operate, and the API URL at hex.pm.

OpenCVE Recommended Actions

Upgrade hex_core to 0.20.0 or later
Upgrade Hex to 2.5.2 or later, which packages hex_core 0.20.0
Reconfigure repository URLs to point to the official repo.hex.pm or to a mirror you control, and set the API URL to hex.pm to avoid untrusted sources

Generated by OpenCVE AI on October 12, 2026 at 19:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00447.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-105274.html
https://github.com/erlang/rebar3/commit/209c02ec57c2cc3207ee0174c3af3675b8dc8f79
https://github.com/erlang/rebar3/commit/360838a22f5b3a88c0358207f2923059bcbb3afb
https://github.com/hexpm/hex/commit/671f695ac548ed01f5828c2a739ecaa942b21007
https://github.com/hexpm/hex/commit/d8b60eee97abb119d525306f048969a217d793a5
https://github.com/hexpm/hex_core/commit/ebe25d110717f6a3addba5232cd4a7dc1c76b628
https://github.com/hexpm/hex_core/commit/fbb6d9de472e5edb8d6fb6b32a91cb266137892e
https://github.com/hexpm/hex_core/security/advisories/GHSA-7c4r-cgf9-9jmq
https://nvd.nist.gov/vuln/detail/CVE-2026-105274
https://osv.dev/vulnerability/EEF-CVE-2026-105274
https://www.cve.org/CVERecord?id=CVE-2026-105274

History

Thu, 15 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 14 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-105274 https://www.cve.org/CVERecord?id=CVE-2026-105274
Metrics	threat_severity `None`	cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L'}` threat_severity `Low`

Mon, 12 Oct 2026 18:45:00 +0000

Type	Values Removed	Values Added
Description	Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api). hex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it. hex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:safe_binary_to_term/1, which calls binary_to_term(Binary, [safe]). The safe option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the safe option and that check without bounding the decoded size. This issue affects rebar3: from 3.9.1 onward; hex: from 2.1.0 before 2.5.2; hex_core: from 0.1.0 before 0.20.0.	Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api). hex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it. hex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:safe_binary_to_term/1, which calls binary_to_term(Binary, [safe]). The safe option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the safe option and that check without bounding the decoded size. This issue affects rebar3: from 3.9.1 before 3.27.3; hex: from 2.1.0 before 2.5.2; hex_core: from 0.1.0 before 0.20.0.
References		https://github.com/erlang/rebar3/commit/360838a22f5b3a88c0358207f2923059bcbb3afb

Mon, 12 Oct 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api). hex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it. hex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:safe_binary_to_term/1, which calls binary_to_term(Binary, [safe]). The safe option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the safe option and that check without bounding the decoded size. This issue affects rebar3: from 3.9.1 onward; hex: from 2.1.0 before 2.5.2; hex_core: from 0.1.0 before 0.20.0.
Title		hex_core decompresses registry and Erlang term API responses without size limits
First Time appeared		Erlang Erlang rebar3 Hexpm Hexpm hex Hexpm hex Core
Weaknesses		CWE-409
CPEs		cpe:2.3:a:erlang:rebar3:::::::: cpe:2.3:a:hexpm:hex:::::::: cpe:2.3:a:hexpm:hex_core::::::::
Vendors & Products		Erlang Erlang rebar3 Hexpm Hexpm hex Hexpm hex Core
References		https://cna.erlef.org/cves/CVE-2026-105274.html https://github.com/erlang/rebar3/commit/209c02ec57c2cc3207ee0174c3af3675b8dc8f79 https://github.com/hexpm/hex/commit/671f695ac548ed01f5828c2a739ecaa942b21007 https://github.com/hexpm/hex/commit/d8b60eee97abb119d525306f048969a217d793a5 https://github.com/hexpm/hex_core/commit/ebe25d110717f6a3addba5232cd4a7dc1c76b628 https://github.com/hexpm/hex_core/commit/fbb6d9de472e5edb8d6fb6b32a91cb266137892e https://github.com/hexpm/hex_core/security/advisories/GHSA-7c4r-cgf9-9jmq https://osv.dev/vulnerability/EEF-CVE-2026-105274
Metrics		cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`

Subscriptions

Erlang Rebar3

Hexpm Hex Hex Core

MITRE

Status: PUBLISHED

Assigner: EEF

Published: 2026-10-12T16:43:58.730Z

Updated: 2026-10-15T18:05:12.446Z

Reserved: 2026-10-10T13:00:02.355Z

Link: CVE-2026-105274

Vulnrichment

Updated: 2026-10-15T17:51:42.437Z

NVD

Status : Deferred

Published: 2026-10-12T17:17:12.457

Modified: 2026-10-15T19:17:15.367

Link: CVE-2026-105274

Redhat

Severity : Low

Publid Date: 2026-10-12T16:43:58Z

Links: CVE-2026-105274 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-12T22:00:16Z

Weaknesses

CWE-409
Improper Handling of Highly Compressed Data (Data Amplification)

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object