Hex/hex_core Data Amplification DoS via Uncompressed Registry/Erlang Term Responses (CVE-2026-105274)

Vulnerability Overview hex_core does not limit size when decompressing registry and Erlang term API responses Description: In , there is a "processing of highly compressed data (data amplification)" vulnerability. This vulnerability allows untrusted repository mirrors or servers responding to API requests to exhaust the memory of the Erlang Virtual Machine (VM) running . Impact: Mirrors can force the allocation of memory far exceeding the response size for each repository fetch. For example, a 65 KB registry response is decompressed into a 64 MB envelope before signature verification failure. API servers or attackers can do the same to API responses: an 8 KB compressed Erlang term format is decompressed into a list with 4.2 million elements. Large responses can halt the Erlang VM, causing build tool commands or processes to fail. No package code needs to be executed. Affected Versions Affected Versions: - : >= 2.1.0 and = 3.9.1 and < 3.27.3 Remediation Fixed Versions: - 0.20.0 - 2.5.2 (includes 0.20.0) Configuration Registry decoding is affected when the repository URL points to a mirror or another server not trusted by the user. Examples include Hex's or , and rebar3's . API decoding is affected when the API URL points to such a server or when an attacker can modify the API response. Requests made over HTTPS are not affected. Workarounds Point the repository URL to or a mirror you control, and the API URL to . References Introduction Commit (Registry Decoding): 7eaf2fd Introduction Commit (API Decoding): d8327f8 Related Advisory: CVE-2026-21819 Additional Information CVE ID: CVE-2026-105274 Weakness: CWE-409 Credits: - Pjotrich (Tinder) - erjcmg (Remediation developer) - maenchen (Analyst) Security Metrics CVSS v4 Base Metrics: - Severity: Low - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Present - Privileges Required: None - User Interaction: Active Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: Low Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Code Block No POC code or exploit code available.

Goal Reached Thanks to every supporter — we hit 100%!

Hex/hex_core Data Amplification DoS via Uncompressed Registry/Erlang Term Responses (CVE-2026-105274)

More from this source