Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103502— hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

Quick assessment

Affected
hexpm hex_core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

不当证书验证漏洞描述 在 库中存在不当证书验证（Improper Certificate Validation）漏洞。该漏洞允许攻击者在能够拦截 HTTPS 连接的情况下，冒充 、 或使用 默认 HTTP 适配器的其他仓库/API 服务器。此影响范围涵盖运行在 Erlang/OTP 24 上的程序，以及在操作系统无法加载 CA（证书颁发机构）证书时运行在 OTP 25 上的程序。 函数会选择内置的 适配器。对于没有配置 选项的 HTTPS 请求， 会构建基于 的服务器证书验证选项。然而，当 调用抛出异常时，适配器会

CVSS 5.9 · Medium EPSS 0.24% · P15

Affected Version Matrix 2

VendorProduct Version RangeStatus
hexpm hex_core 0.1.0< 0.20.0 affected
fbb6d9de472e5edb8d6fb6b32a91cb266137892e< b7b3a42defb4ed8e20a5c68a4412ce68a95b7938 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103502

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating system's CA certificates can't be loaded. hex_core:default_config/0 selects the built-in hex_http_httpc adapter. For an HTTPS request whose adapter config has no ssl option, hex_http_httpc:http_options/2 builds options that verify the server certificate against public_key:cacerts_get/0. When that call raises, the adapter prints a warning and sends the request without ssl options, so httpc uses the defaults of the ssl application, which before OTP 26 don't verify the server certificate. public_key:cacerts_get/0 doesn't exist on OTP 24, so every HTTPS request falls back there, and on OTP 25 it raises when no CA store is found. hex_core versions before 0.11.0 never set ssl options, so they don't verify the server certificate on OTP 25 and earlier whether or not a CA store is found. The fallback was intended and documented, but the documentation didn't make clear that it meant no certificate verification. Since hex_core 0.8.2 the README has warned that the built-in httpc adapter "has insecure default settings" and recommended other HTTP clients, and the adapter prints "using default ssl options which are insecure" on every request that falls back. hex_core 0.11.0 added certificate verification with the changelog entry "Use secure SSL defaults for OTP 25+". Neither the README nor the warning says that the server certificate isn't verified, the README doesn't say which OTP versions the warning applies to, and on OTP 25 without CA certificates the warning tells users to upgrade to OTP 25 or later, which they already run. This advisory is published so that users who took those notices as general advice know their HTTPS requests weren't authenticated. This issue affects hex_core: from 0.1.0 before 0.20.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
hexpm hex_core 0.1.0 ~ 0.20.0 cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*
hexpm hex_core fbb6d9de472e5edb8d6fb6b32a91cb266137892e ~ b7b3a42defb4ed8e20a5c68a4412ce68a95b7938 cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-103502

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103502

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-103502 (1)

Vendor Advisories for CVE-2026-103502 (2)

Other References for CVE-2026-103502 (1)

Same Patch Batch · hexpm · 2026-10-12 · 7 CVEs total

CVE-2026-96612 7.5 HIGH Path traversal in Hex via unvalidated dependency app names
CVE-2026-105668 7.1 HIGH Hex release-age cooldown is lifted package-wide when the locked release is retired
CVE-2026-105280 6.9 MEDIUM Hex writes unverified package tarballs to standard output in mix hex.package fetch
CVE-2026-103503 5.9 MEDIUM Hex trusts its bundled CA certificates when cacerts_path is set
CVE-2026-81856 2.3 LOW Terminal escape sequence injection in Hex via unneutralized server-supplied output
CVE-2026-96618 2.1 LOW Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

IV. Related Vulnerabilities

Same product: hex_core
Same vendor: hexpm
Same weakness: CWE-295

V. Comments for CVE-2026-103502

No comments yet

Leave a comment