Hex CVE-2026-96618

Exploitation requires that the victim has a non-default, attacker-controlled Hex mirror configured via HEX_MIRROR_URL, HEX_MIRROR, or the mirror_url option, AND actively runs one of mix deps.get, mix deps.update, mix hex.package fetch, mix hex.docs fetch (or mix hex.docs offline when docs are missing). The vulnerable paths - Hex.HTTP.request/5 gzip decompression via :zlib.gunzip/1, unbounded package tarball download/unpack, and docs tarball extraction via :mix_hex_erl_tar.extract/2 - all consume memory or disk in proportion to attacker-supplied data before signature and 16 MiB/128 MiB size checks run. Limiting factors that reduce real-world risk: the default hex.pm CDN is not affected (only a configured untrusted mirror is), explicit user action is required to trigger a fetch, docs tarballs are not covered by the registry signature at all, and impact is limited to resource exhaustion (no code execution or data disclosure).

This is a genuinely low-priority issue despite being a real, vendor-confirmed vulnerability. The CVSS 4.0 base score of 2.1 (vendor/erlef CNA) is consistent with the vector: impact is confined to availability (VC:N/VI:N/VA:L) - a denial-of-service via memory/disk exhaustion, with no confidentiality or integrity consequence. Crucially, exploitation carries an attack requirement (AT:P) and active user interaction (UI:A): the victim must already have an attacker-controlled Hex mirror configured (HEX_MIRROR_URL/HEX_MIRROR/mirror_url) and must run a fetch command (mix deps.get, deps.update, hex.package fetch, or hex.docs fetch). This is a significant limiting factor - the default configuration uses hex.pm's own CDN, not an untrusted mirror, so most deployments are not exposed. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit was supplied, so there is no signal of real-world exploitation. The AV:N vector is accurate in that the malicious payload arrives over the network, but it should not be read as 'remotely exploitable against any default install' - the network attacker must occupy the position of the configured mirror. Net assessment: a legitimate supply-chain hardening fix worth patching in CI/build environments that use third-party mirrors, but not an urgent, widely-exploitable threat.

A development team or CI pipeline configures a third-party or internal Hex mirror via HEX_MIRROR_URL and runs mix deps.get or mix hex.docs fetch. The malicious (or compromised) mirror returns a gzip-compressed decompression bomb, or an oversized package/docs tarball, which Hex reads fully into memory and decompresses with no size limit before any registry-signature or checksum validation runs, exhausting the host's memory or disk and crashing the build. No public exploit was identified at time of analysis.