The vulnerability stems from unsafe deserialization of Erlang terms in the hex_core, hex, and rebar3 products, allowing an attacker to inject malicious objects that can cause excessive allocation of system resources. This can lead to denial of service conditions by exhausting memory or processing capacity. The weakness is identified as resource exhaustion and deserialization of untrusted data, mapped to CWE‑400 and CWE‑502.

Affected vendors and products include Erlang’s rebar3, Hex’s hex, and hex_core. Specific vulnerable versions are: rebar3 3.9.1 through 3.26.x, hex 2.3.0 through 2.3.1, and hex_core 0.1.0 through 0.12.0.

The CVSS score is 2.0, indicating a low severity, and the EPSS score is less than 1%, signaling a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no mass exploitation evidence. The likely attack vector is an application or module that loads untrusted data into these libraries; downstream applications that use these modules may be affected if they process external input unfiltered. Exploitation would require the attacker to provide malicious Erlang terms to one of the deserialization routines, resulting in uncontrolled resource allocation.