AIKIDO-2026-73253
hex_core is vulnerable to Denial of Service (DoS)
21
Low Risk
This Affects:
hex_coreTL;DR
hex_core decompresses registry and Erlang term API responses without size limits. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api). hex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
hex_core is vulnerable to Denial of Service (DoS) in versions 0.1.0 - 0.19.0.
How to fix this
Upgrade the hex_core library to the patch version.
Links
Fix Commits
github.com/erlang/rebar3/commit/209c02ec57c2cc3207ee0174c3af3675b8dc8f79github.com/erlang/rebar3/commit/360838a22f5b3a88c0358207f2923059bcbb3afbgithub.com/hexpm/hex/commit/671f695ac548ed01f5828c2a739ecaa942b21007github.com/hexpm/hex/commit/d8b60eee97abb119d525306f048969a217d793a5github.com/hexpm/hex_core/commit/ebe25d110717f6a3addba5232cd4a7dc1c76b628github.com/hexpm/hex_core/commit/fbb6d9de472e5edb8d6fb6b32a91cb266137892e
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.