The vulnerability allows an attacker to exhaust the memory of the Hex.pm service by uploading an oversized package tarball. During extraction, the service consumes uncontrolled amounts of memory, eventually crashing the application instance and halting package publishing and other processing functions. The primary consequence is a complete service disruption for any affected deployments.

Affected versions include hexpm:hex.pm before commit 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 and hexpm:hexpm before 2026‑03‑10. These releases run the Hex.pm platform that hosts Elixir packages and are therefore susceptible to the denial‑of‑service noted above.

CVSS score 7.1 indicates a medium‑to‑high impact, but the EPSS score is below 1%, suggesting low current exploitation likelihood, and the vulnerability is not listed in the KEV catalog. Attackers would need the ability to publish a package; by sending an oversized upload to the Hex.pm endpoint, the memory exhaustion can be triggered. While the risk is moderate, any successful exploitation would cause a full service outage for the affected instance.