hexpm hex_core
4 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-96596 | 0.14.0 – < 0.20.1 | erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-105274 | 0.1.0 – < 0.20.0 | hex_core decompresses registry and Erlang term API responses without size limits | LOW 2.1 | 0.4 % | ||
| CVE-2026-103502 | 0.1.0 – < 0.20.0 | hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-21619 | eb327f8edfe45507351e38cc0805aa12fa647f0b – < cdf726095bca85ad2549d146df1e831ae93c2b13 | Unsafe Deserialization of Erlang Terms in hex_core | LOW 2.0 | 0.6 % |