AIKIDO-2026-265904
hex_core is vulnerable to Improper Certificate Validation
59
Medium Risk
This Affects:
hex_coreTL;DR
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25. hex_core:default_config/0 selects the built-in hex_http_httpc adapter. For an HTTPS request whose adapter config has no ssl option, hex_http_httpc:http_options/2 builds options that verify the server certificate against public_key:cacerts_get/0.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
hex_core is vulnerable to Improper Certificate Validation in versions 0.1.0 - 0.19.0.
How to fix this
Upgrade the hex_core library to the patch version.
Links
Fix Commits
github.com/hexpm/hex_core/commit/b7b3a42defb4ed8e20a5c68a4412ce68a95b7938github.com/hexpm/hex_core/commit/fbb6d9de472e5edb8d6fb6b32a91cb266137892e
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.