The vulnerability is an uncontrolled resource consumption flaw in Hex.pm that permits an attacker to trigger excessive memory usage by uploading an oversized package tarball. When the service extracts the tarball, it runs out of memory, causing the application instance to terminate. This results in a denial of service for package publishing and other package‑processing functions.

Affected versions include hexpm:hexpm before commit 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 and hexpm:hexpm before 2026‑03‑10. These releases run the Hex.pm platform that hosts Elixir packages and are therefore susceptible to the denial‑of‑service noted above.

CVSS score 7.1 indicates a medium‑to‑high impact, but the EPSS score is below 1%, suggesting low current exploitation likelihood, and the vulnerability is not listed in the KEV catalog. Attackers would need the ability to publish a package; by sending an oversized upload to the Hex.pm endpoint, the memory exhaustion can be triggered. While the risk is moderate, any successful exploitation would cause a full service outage for the affected instance.