Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-96618— Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Quick assessment

Affected
hexpm hex
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： 高压缩数据处理不当（数据放大）漏洞 存在于 hexpm hex 中。该漏洞允许不受信任的软件包镜像耗尽运行 、 、 或 的机器的内存或磁盘空间。 Hex 将配置了 、 或 的镜像视为不受信任：它不会向其发送凭据，并且会检查注册表签名和软件包校验和，以防止镜像伪造这些签名。然而，在运行任何这些检查之前，有几个响应路径会根据镜像发送的数据量成比例地消耗内存或磁盘空间。 函数会将整个响应正文读取到内存中，并在响应的 包含 时通过 对其进行解压缩，且不对压缩前或解压缩后的大小设置任何限制。

CVSS 2.1 · Low

Affected Version Matrix 2

VendorProduct Version RangeStatus
hexpm hex 0.11.2< 2.5.2 affected
51ea632424fb6ea8765148f96dc25dfeb526b1f8< * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-96618

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with HEX_MIRROR_URL, HEX_MIRROR or mirror_url as untrusted: it doesn't send credentials to it, and it checks registry signatures and package checksums that the mirror can't forge. Several response paths consume memory or disk in proportion to what the mirror sends before any of those checks run. Hex.HTTP.request/5 reads the whole response body into memory and decompresses it with :zlib.gunzip/1 whenever the response's Content-Encoding contains gzip, with no limit on the compressed or decompressed size. Hex doesn't ask for compressed responses, so the server decides whether this step runs. It applies to registry, package, docs and API responses. Package tarballs have no download size limit. Hex 2.5.1 holds the whole tarball in memory and writes it to the cache, and the development branch streams it to a temporary file; the 16 MiB tarball limit is checked only when the file is unpacked. The tarball is then unpacked, into deps/<app> in 2.5.1 and into a staging directory on the development branch, before its checksums are compared with the registry. mix hex.docs fetch, and mix hex.docs offline when docs are missing, write the docs tarball to disk and extract it with :mix_hex_erl_tar.extract/2 without the 16 MiB compressed and 128 MiB decompressed limits that mix_hex_tarball:unpack_docs/3 applies. The signed registry doesn't cover docs tarballs, so nothing checks them. Registry responses are also decompressed before their signature is checked, in hex_core code that Hex vendors; that part is tracked in https://github.com/hexpm/hex_core/security/advisories/GHSA-7c4r-cgf9-9jmq. This issue affects hex: from 0.11.2 before 2.5.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
hexpm hex 0.11.2 ~ 2.5.2 cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*
hexpm hex 51ea632424fb6ea8765148f96dc25dfeb526b1f8 ~ * cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-96618

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-96618

请登录查看更多情报信息。

Other References for CVE-2026-96618 (6)

Same Patch Batch · hexpm · 2026-10-12 · 7 CVEs total

CVE-2026-96612 7.5 HIGH Path traversal in Hex via unvalidated dependency app names
CVE-2026-105668 7.1 HIGH Hex release-age cooldown is lifted package-wide when the locked release is retired
CVE-2026-105280 6.9 MEDIUM Hex writes unverified package tarballs to standard output in mix hex.package fetch
CVE-2026-103502 5.9 MEDIUM hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
CVE-2026-103503 5.9 MEDIUM Hex trusts its bundled CA certificates when cacerts_path is set
CVE-2026-81856 2.3 LOW Terminal escape sequence injection in Hex via unneutralized server-supplied output

IV. Related Vulnerabilities

Same product: hex
Same vendor: hexpm
Same weakness: CWE-409

V. Comments for CVE-2026-96618

No comments yet

Leave a comment