目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2026-59247— gleam 输入验证错误漏洞

一分钟漏洞结论

影响对象
gleam-lang gleam
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

gleam是Gleam组织开源的一个类型安全的可扩展系统构建语言。 gleam 0.18.0版本至1.18.0之前版本存在输入验证错误漏洞，该漏洞源于数据真实性验证不足，导致中间人攻击者可在依赖解析过程中替换伪造的Hex包内容，造成下载包完整性受损。

CVSS 7.6 · High EPSS 0.18% · P7

影响版本矩阵 13

厂商产品 版本范围状态
gleam-lang gleam 0.18.0< 1.18.0 affected
0.18.0< 1.18.0 affected
8447b78cc844ff4aec44eea23dbd68d1fea11f11< c9c0d48c123c8abae6db8dd61b25ccb427ed3d35 affected
v0.18.0-elixir< v1.18.0-elixir affected
v0.18.0-elixir-slim< v1.18.0-elixir-slim affected
v0.18.0-elixir-alpine< v1.18.0-elixir-alpine affected
v0.18.0-erlang< v1.18.0-erlang affected
v0.18.0-erlang-slim< v1.18.0-erlang-slim affected
… +5 条更多
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-59247 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Insufficient verification of Hex package metadata in Gleam
来源: CVE Program / CVE List V5
Vulnerability Description
Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each release's dependency requirements and SHA-256 outer_checksum. After resolving versions, gleam_cli::dependencies::lookup_package makes a second request to the unsigned Hex API through gleam_core::hex::get_package_release and records the outer_checksum and dependency names from that JSON response into manifest.toml, instead of the values from the verified repository metadata. The Hex repository signature does not cover the API response. An adversary in the middle who can intercept TLS with a certificate trusted by the Gleam process (for example a TLS-inspecting proxy using a CA in the operating system trust store or added through GLEAM_CACERTS_PATH), and who can modify both the API release response and the corresponding repository tarball, can supply a package archive with a matching forged checksum without the Hex repository signing key. Gleam verifies the forged tarball against the forged checksum, accepts it, and extracts it as a dependency source, resulting in loss of integrity of the downloaded package contents. Only projects that resolve or update Hex dependencies are affected, which happens when the manifest is missing, a dependency is added or updated, or dependency requirements change. Builds that reuse an unchanged, known-good manifest.toml continue to verify tarballs against its pinned checksum. This issue affects gleam: from 0.18.0 before 1.18.0.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
来源: CVE Program / CVE List V5
Vulnerability Title
gleam 输入验证错误漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
gleam是Gleam组织开源的一个类型安全的可扩展系统构建语言。 gleam 0.18.0版本至1.18.0之前版本存在输入验证错误漏洞，该漏洞源于数据真实性验证不足，导致中间人攻击者可在依赖解析过程中替换伪造的Hex包内容，造成下载包完整性受损。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD

受影响产品

厂商 产品 影响版本 CPE 订阅
gleam-lang gleam 0.18.0 ~ 1.18.0 cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*
gleam-lang gleam 0.18.0 ~ 1.18.0 cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*
gleam-lang gleam v0.18.0-elixir ~ v1.18.0-elixir cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*

二、漏洞 CVE-2026-59247 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级
Qwen3.6-35B-A3B · 8488 chars
Pro+ 专属包含：
漏洞复现靶场录像（真实沙箱构建 + 触发，独家）
漏洞原理深度分析
触发条件与影响面
完整可执行 POC 代码
利用链与缓解建议
POC 打包下载
每月 100+ 条 AI 生成额度

三、漏洞 CVE-2026-59247 的情报信息

请登录查看更多情报信息。

CVE-2026-59247 补丁与修复 (1)

CVE-2026-59247 厂商安全公告 (3)

IV. Related Vulnerabilities

Same product: gleam
Same weakness: CWE-345

V. Comments for CVE-2026-59247

暂无评论

发表评论