EUVD-2026-12050Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Hex.pm package repository
-
DeliveryCreate oversized tarball package
-
ExploitUpload package to Hex.pm registry
-
ExecutionTrigger memory exhaustion during extraction
-
ImpactDenial of service to package publishing
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user account on Hex.pm required. Ability to upload packages to the repository. Vulnerable hexpm versions before commit 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 or hex.pm instances before 2026-03-10. |
| Impact | The CVSS 4.0 score of 7.1 reflects a network-accessible vulnerability requiring low privileges and no user interaction, with high availability impact but no confidentiality or integrity concerns. The attack complexity is low, making it relatively easy to execute once an attacker has valid credentials to publish packages. Without EPSS data or KEV listing, and lacking evidence of public exploits or POCs, this appears to be a theoretical risk rather than an actively targeted vulnerability. The SSVC framework would likely categorize this as a medium priority given the need for authentication, manual exploitation requirement, and limited technical impact (DoS only). While the CVSS score is high, the real-world risk is moderated by the authentication requirement and the specific targeting needed. |
| Exploit ScenarioDerived | An attacker with valid package publishing credentials creates a malicious package containing an extremely large tarball or deeply nested archive structure, then uploads it to the target hex.pm instance. During the extraction process, the server allocates excessive memory trying to process the oversized package, eventually exhausting available RAM and causing the application instance to crash, preventing legitimate users from publishing or accessing packages until the service recovers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
An uncontrolled resource consumption vulnerability in the Hex.pm package manager allows authenticated attackers to cause denial of service by uploading oversized packages that exhaust server memory during extraction. The vulnerability affects hexpm versions before commit 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 and hex.pm installations before March 10, 2026, with a CVSS 4.0 score of 7.1 indicating high availability impact. No active exploitation has been reported (not in KEV), no public proof-of-concept exists, and EPSS data is not available.
RemediationAI
Organizations running hex.pm instances should upgrade to versions containing commit 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 or ensure their deployment is updated to post-March 10, 2026 releases. As an interim mitigation, administrators should implement package size limits at the web server or load balancer level, monitor memory usage patterns for anomalies during package uploads, and consider implementing rate limiting for package publishing operations to prevent rapid successive attempts at resource exhaustion.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Hex.pm is the package manager for the Erlang ecosystem, used to host and distribute Erlang and Elixir packages. The vulnerability stems from CWE-400 (Uncontrolled Resource Consumption), where the application fails to properly limit memory allocation when processing uploaded package tarballs, allowing malicious actors to upload specially crafted oversized packages that consume excessive memory during the extraction phase. This affects the core package publishing and processing functionality of the hex.pm service, potentially impacting the entire Erlang/Elixir development ecosystem that relies on this infrastructure.
Know when Hexpm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (EEF) · only source for this CVE.
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality.
This issue affects hexpm: before 495f01607d3eae4aed7ad09b2f54f31ec7a7df01; hex.pm: before 2026-03-10.
Executive ViewAI
A denial-of-service vulnerability in Hex.pm package repository infrastructure allows attackers to crash package publishing services by uploading oversized packages, disrupting development workflows for Elixir/Erlang teams that depend on package distribution. Organizations using Hex.pm for internal or public package management face potential service interruptions that could block deployments and slow software delivery.
Apply vendor patch. If immediate patching is unavailable: implement upload size limits at reverse proxy/load balancer (e.g., restrict package tarballs to known safe threshold); enable request timeouts on package publishing endpoints; implement rate limiting per IP/publisher; monitor application memory usage with alerts for abnormal consumption during publishing operations; restrict package publishing access to authenticated users only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Insufficient session expiration in hexpm. Password reset tokens never expire, enabling persistent account takeover.
Silent dependency checksum bypass in hexpm/hex package manager (versions 0.16.0 through 2.4.1) allows attackers to subst
Improper input sanitization in hexpm's SharedAuthorizationView module allows unauthenticated attackers to inject malicio
Incorrect authorization in the hex.pm OAuth `client_credentials` endpoint allows any API key bearing the `repositories`
Path traversal in the Hex package manager for the Elixir/Erlang (Mix) ecosystem, versions 0.6.0 through 2.5.1, lets a ma
Hex, the package manager used by Elixir and Erlang projects, fails to properly scope its 'release-age cooldown' protecti
Hexpm's OAuth implementation fails to enforce read-only API key restrictions during token exchange, allowing an attacker
Integrity-check bypass in the Hex package manager (hexpm hex) allows a compromised or attacker-controlled package mirror
Path traversal in hexpm's Local Storage backend allows unauthenticated attackers to read sensitive files through relativ
Improper TLS server-certificate validation in hex_core (0.1.0 through versions before 0.20.0) lets an attacker who alrea
Improper certificate validation in Hex (the Elixir/Erlang package manager client, versions 0.20.2 through 2.5.1) allows
Denial of service in Erlang OTP's stdlib erl_tar module (OTP 29.0 before 29.1.2, stdlib 8.0 before 8.1.1) allows an atta
Exploit-DB