Insufficient Data Authenticity Verification in Gleam Affects Package Integrity

CVE-2026-59247

What is CVE-2026-59247?

A vulnerability in Gleam allows attackers to compromise package integrity during dependency resolution. The issue arises when Gleam fetches package metadata from a signature-verified Hex repository but later requests unverified data from the unsigned Hex API. If an attacker intercepts this communication, they can provide a forged package archive that Gleam accepts, resulting in potential integrity loss of the downloaded packages. This affects projects that update or resolve Hex dependencies when their manifests lack necessary information.

References