Data Amplification Vulnerability in Hex Core Affects Hex and Rebar3

CVE-2026-105274

What is CVE-2026-105274?

A vulnerability in HexPM's Hex Core could allow an untrusted repository mirror to exploit the application by sending highly compressed data. Specifically, API requests such as hex_repo:get_names/1 and hex_repo:get_versions/1 do not properly limit the size of the data being decompressed, potentially causing memory exhaustion in the Erlang VM that runs Hex Core. This vulnerability arises from the fact that while a mirror cannot access the private key to verify signatures, it can still control the size of the compressed response. Therefore, small data inputs can decompress into large responses, leading to excessive memory consumption. The issue has been patched in versions of Hex and Rebar3, providing necessary safeguards against such attacks.

References