Improper Certificate Validation in hex_core Affecting Hexpm

CVE-2026-103502

What is CVE-2026-103502?

The hex_core library in Hexpm has a vulnerability stemming from improper certificate validation, enabling an attacker to intercept HTTPS connections and impersonate repositories or API servers. This means that software utilizing the default HTTP adapter may send requests without verifying server certificates, particularly in specific configurations on Erlang/OTP versions 24 and 25. The lack of clear documentation and warning messages regarding the insecure default settings exacerbates the risk, leaving users potentially unaware that their communications may be compromised. It is important for users to be aware that prior to version 0.11.0, hex_core did not adequately verify server certificates, a detail that was insufficiently communicated in existing documentation.

References