CVE-2026-21619

Unsafe Deserialization of Erlang Terms in hex_core

Published Feb 27, 2026 CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Description

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4.

This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.

Analysis

Technical impact

The vulnerability stems from unsafe deserialization of Erlang terms in the hex_core, hex, and rebar3 products, allowing an attacker to inject malicious objects that can cause excessive allocation of system resources. This can lead to denial of service conditions by exhausting memory or processing capacity. The weakness is identified as resource exhaustion and deserialization of untrusted data, mapped to CWE‑400 and CWE‑502.

Affected Systems

Affected vendors and products include Erlang’s rebar3, Hex’s hex, and hex_core. Specific vulnerable versions are: rebar3 3.9.1 through 3.26.x, hex 2.3.0 through 2.3.1, and hex_core 0.1.0 through 0.12.0.

Risk and Exploitability

The CVSS score is 2.0, indicating a low severity, and the EPSS score is less than 1%, signaling a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no mass exploitation evidence. The likely attack vector is an application or module that loads untrusted data into these libraries; downstream applications that use these modules may be affected if they process external input unfiltered. Exploitation would require the attacker to provide malicious Erlang terms to one of the deserialization routines, resulting in uncontrolled resource allocation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

hexpm

hex_core

unaffected

Version	Status	Constraints
`eb327f8edfe45507351e38cc0805aa12fa647f0b`	affected	< cdf726095bca85ad2549d146df1e831ae93c2b13

hexpm

hex_core

unaffected

Version	Status	Constraints
`0.1.0`	affected	< 0.12.1

hexpm

hex

unaffected

Version	Status	Constraints
`314546ac432229518714cc8e3336e916b9da6305`	affected	< 636739f3322514e9303ca335fb630696fcbb3c95

hexpm

hex

unaffected

Version	Status	Constraints
`2.3.0`	affected	< 2.3.2

erlang

rebar3

unaffected

Version	Status	Constraints
`209c02ec57c2cc3207ee0174c3af3675b8dc8f79`	affected	< 1d4478f527e373de0b225951e53115450e0d9b9d

erlang

rebar3

unaffected

Version	Status	Constraints
`3.9.1`	affected	< 3.27.0

Configuration 1 [-]

OR	cpe:2.3:a:erlang:rebar3::::::::
	cpe:2.3:a:hex:hex::::::::
	cpe:2.3:a:hex:hex_core::::::::

No data.

Vendor Product Versions

Erlang

Rebar3

Version	Status	Scheme	Platform
`[209c02ec57c2cc3207ee0174c3af3675b8dc8f79, 1d4478f527e373de0b225951e53115450e0d9b9d)`	affected	code_commit	—
`[3.9.1,3.27.0)`	affected	semver	—
`[pkg:otp/rebar3@3.9.1, pkg:otp/rebar3@3.27.0)`	affected	generic	—

Erlang

Rebar3

Version	Status	Scheme	Platform
`[3.9.1,3.27.0)`	affected	semver	—
`[pkg:otp/rebar3@3.9.1, pkg:otp/rebar3@3.27.0)`	affected	generic	—

Hexpm

Hex

Version	Status	Scheme	Platform
`[314546ac432229518714cc8e3336e916b9da6305, 636739f3322514e9303ca335fb630696fcbb3c95)`	affected	code_commit	—
`[2.3.0,2.3.2)`	affected	semver	—
`[pkg:hex/hex@2.3.0, pkg:hex/hex@2.3.2)`	affected	generic	—

Hexpm

Hex

Version	Status	Scheme	Platform
`[2.3.0,2.3.2)`	affected	semver	—
`[pkg:hex/hex@2.3.0, pkg:hex/hex@2.3.2)`	affected	generic	—

Hexpm

Hex Core

Version	Status	Scheme	Platform
`[eb327f8edfe45507351e38cc0805aa12fa647f0b, cdf726095bca85ad2549d146df1e831ae93c2b13)`	affected	code_commit	—
`[0.1.0,0.12.1)`	affected	semver	—
`[pkg:hex/hex_core@0.1.0, pkg:hex/hex_core@0.12.1)`	affected	generic	—

Hexpm

Hex Core

Version	Status	Scheme	Platform
`[0.1.0,0.12.1)`	affected	semver	—
`[pkg:hex/hex_core@0.1.0, pkg:hex/hex_core@0.12.1)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade all affected products to at least rebar3 3.27.0, hex 2.3.2, and hex_core 0.12.1 or later, which contain the deserialization fix.
If an upgrade is not immediately possible, apply the security patches from the commit records linked in the advisory (hex_core: cdf72609, hex: 636739f3, rebar3: 1d4478f5) to remove the unsafe deserialization logic.
Restrict or validate all external data before passing it to the hex_core, hex, or rebar3 APIs to ensure only trusted Erlang terms are processed.

Generated by OpenCVE AI on April 15, 2026 at 23:50 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-hx9w-f2w9-9g96	hex_core has Unsafe Deserialization of Erlang Terms

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.638% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-21619.html
https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d
https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95
https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13
https://github.com/hexpm/hex_core/security/advisories/GHSA-hx9w-f2w9-9g96
https://osv.dev/vulnerability/EEF-CVE-2026-21619

History

Apr 6, 2026 4:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://cna.erlef.org/cves/CVE-2026-21619.html https://osv.dev/vulnerability/EEF-CVE-2026-21619

Mar 23, 2026 5:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Hex Hex hex Hex hex Core
CPEs		cpe:2.3:a:hex:hex:::::::: cpe:2.3:a:hex:hex_core::::::::
Vendors & Products		Hex Hex hex Hex hex Core
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Feb 27, 2026 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 27, 2026 6:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
Title		Unsafe Deserialization of Erlang Terms in hex_core
First Time appeared		Erlang Erlang rebar3 Hexpm Hexpm hex Hexpm hex Core
Weaknesses		CWE-400 CWE-502
CPEs		cpe:2.3:a:erlang:rebar3:::::::: cpe:2.3:a:hexpm:hex:::::::: cpe:2.3:a:hexpm:hex_core::::::::
Vendors & Products		Erlang Erlang rebar3 Hexpm Hexpm hex Hexpm hex Core
References		https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95 https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13 https://github.com/hexpm/hex_core/security/advisories/GHSA-hx9w-f2w9-9g96
Metrics		cvssV4_0 `{'score': 2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`