Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-59247— Insufficient verification of Hex package metadata in Gleam

Quick assessment

Affected
gleam-lang gleam
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

gleam是Gleam组织开源的一个类型安全的可扩展系统构建语言。 gleam 0.18.0版本至1.18.0之前版本存在输入验证错误漏洞，该漏洞源于数据真实性验证不足，导致中间人攻击者可在依赖解析过程中替换伪造的Hex包内容，造成下载包完整性受损。

CVSS 7.6 · High EPSS 0.18% · P7

Affected Version Matrix 13

VendorProduct Version RangeStatus
gleam-lang gleam 0.18.0< 1.18.0 affected
0.18.0< 1.18.0 affected
8447b78cc844ff4aec44eea23dbd68d1fea11f11< c9c0d48c123c8abae6db8dd61b25ccb427ed3d35 affected
v0.18.0-elixir< v1.18.0-elixir affected
v0.18.0-elixir-slim< v1.18.0-elixir-slim affected
v0.18.0-elixir-alpine< v1.18.0-elixir-alpine affected
v0.18.0-erlang< v1.18.0-erlang affected
v0.18.0-erlang-slim< v1.18.0-erlang-slim affected
… +5 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59247

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Insufficient verification of Hex package metadata in Gleam
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each release's dependency requirements and SHA-256 outer_checksum. After resolving versions, gleam_cli::dependencies::lookup_package makes a second request to the unsigned Hex API through gleam_core::hex::get_package_release and records the outer_checksum and dependency names from that JSON response into manifest.toml, instead of the values from the verified repository metadata. The Hex repository signature does not cover the API response. An adversary in the middle who can intercept TLS with a certificate trusted by the Gleam process (for example a TLS-inspecting proxy using a CA in the operating system trust store or added through GLEAM_CACERTS_PATH), and who can modify both the API release response and the corresponding repository tarball, can supply a package archive with a matching forged checksum without the Hex repository signing key. Gleam verifies the forged tarball against the forged checksum, accepts it, and extracts it as a dependency source, resulting in loss of integrity of the downloaded package contents. Only projects that resolve or update Hex dependencies are affected, which happens when the manifest is missing, a dependency is added or updated, or dependency requirements change. Builds that reuse an unchanged, known-good manifest.toml continue to verify tarballs against its pinned checksum. This issue affects gleam: from 0.18.0 before 1.18.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Vulnerability Title
gleam 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
gleam是Gleam组织开源的一个类型安全的可扩展系统构建语言。 gleam 0.18.0版本至1.18.0之前版本存在输入验证错误漏洞，该漏洞源于数据真实性验证不足，导致中间人攻击者可在依赖解析过程中替换伪造的Hex包内容，造成下载包完整性受损。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
gleam-lang gleam 0.18.0 ~ 1.18.0 cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*
gleam-lang gleam 0.18.0 ~ 1.18.0 cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*
gleam-lang gleam v0.18.0-elixir ~ v1.18.0-elixir cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-59247

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 12352 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-59247

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-59247 (1)

Vendor Advisories for CVE-2026-59247 (3)

IV. Related Vulnerabilities

Same product: gleam
Same weakness: CWE-345

V. Comments for CVE-2026-59247

No comments yet

Leave a comment