{"id":"CVE-2026-105274","revision":"f354464f74a647eaa2855a41a77309ba","records":[{"revision":"f354464f74a647eaa2855a41a77309ba","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-105274","aliases":[],"title":"hex_core decompresses registry and Erlang term API responses without size limits","description":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api).\n\nhex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it.\n\nhex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:safe_binary_to_term/1, which calls binary_to_term(Binary, [safe]). The safe option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the safe option and that check without bounding the decoded size.\n\nThis issue affects rebar3: from 3.9.1 before 3.27.3; hex: from 2.1.0 before 2.5.2; hex_core: from 0.1.0 before 0.20.0.","state":0,"publishedAt":"2026-10-12T16:43:58.73+00:00","modifiedAt":"2026-10-15T18:05:12.446+00:00","affected":[{"ecosystem":"Vendor product","name":"rebar3","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"cpes\": [\n                        \"cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"r3_hex_repo\",\n                        \"r3_hex_api\"\n                    ],\n                    \"packageName\": \"rebar3\",\n                    \"packageURL\": \"pkg:otp/rebar3?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Frebar3&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Frebar3.git\",\n                    \"product\": \"rebar3\",\n                    \"programFiles\": [\n                        \"apps/rebar/src/vendored/r3_hex_repo.erl\",\n                        \"apps/rebar/src/vendored/r3_hex_api.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"r3_hex_repo:get_names/1\"\n                        },\n                        {\n                            \"name\": \"r3_hex_repo:get_versions/1\"\n                        },\n                        {\n                            \"name\": \"r3_hex_repo:get_package/2\"\n                        },\n                        {\n                            \"name\": \"r3_hex_api:request/4\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/erlang/rebar3\",\n                    \"vendor\": \"erlang\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"3.27.3\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.9.1\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://github.com","name":"erlang/rebar3","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://github.com\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"r3_hex_repo\",\n                        \"r3_hex_api\"\n                    ],\n                    \"packageName\": \"erlang/rebar3\",\n                    \"packageURL\": \"pkg:github/erlang/rebar3\",\n                    \"product\": \"rebar3\",\n                    \"programFiles\": [\n                        \"apps/rebar/src/vendored/r3_hex_repo.erl\",\n                        \"apps/rebar/src/vendored/r3_hex_api.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"r3_hex_repo:get_names/1\"\n                        },\n                        {\n                            \"name\": \"r3_hex_repo:get_versions/1\"\n                        },\n                        {\n                            \"name\": \"r3_hex_repo:get_package/2\"\n                        },\n                        {\n                            \"name\": \"r3_hex_api:request/4\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/erlang/rebar3\",\n                    \"vendor\": \"erlang\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"360838a22f5b3a88c0358207f2923059bcbb3afb\",\n                            \"status\": \"affected\",\n                            \"version\": \"209c02ec57c2cc3207ee0174c3af3675b8dc8f79\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://repo.hex.pm","name":"hex_core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://repo.hex.pm\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"hex_repo\",\n                        \"hex_api\",\n                        \"hex_safe_binary_to_term\"\n                    ],\n                    \"packageName\": \"hex_core\",\n                    \"packageURL\": \"pkg:hex/hex_core\",\n                    \"product\": \"hex_core\",\n                    \"programFiles\": [\n                        \"src/hex_repo.erl\",\n                        \"src/hex_api.erl\",\n                        \"src/hex_safe_binary_to_term.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"hex_repo:get_names/1\"\n                        },\n                        {\n                            \"name\": \"hex_repo:get_versions/1\"\n                        },\n                        {\n                            \"name\": \"hex_repo:get_package/2\"\n                        },\n                        {\n                            \"name\": \"hex_repo:get_policy/2\"\n                        },\n                        {\n                            \"name\": \"hex_api:request/4\"\n                        },\n                        {\n                            \"name\": \"hex_safe_binary_to_term:safe_binary_to_term/1\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/hexpm/hex_core\",\n                    \"vendor\": \"hexpm\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"0.20.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"0.1.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://github.com","name":"hexpm/hex_core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://github.com\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"hex_repo\",\n                        \"hex_api\",\n                        \"hex_safe_binary_to_term\"\n                    ],\n                    \"packageName\": \"hexpm/hex_core\",\n                    \"packageURL\": \"pkg:github/hexpm/hex_core\",\n                    \"product\": \"hex_core\",\n                    \"programFiles\": [\n                        \"src/hex_repo.erl\",\n                        \"src/hex_api.erl\",\n                        \"src/hex_safe_binary_to_term.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"hex_repo:get_names/1\"\n                        },\n                        {\n                            \"name\": \"hex_repo:get_versions/1\"\n                        },\n                        {\n                            \"name\": \"hex_repo:get_package/2\"\n                        },\n                        {\n                            \"name\": \"hex_repo:get_policy/2\"\n                        },\n                        {\n                            \"name\": \"hex_api:request/4\"\n                        },\n                        {\n                            \"name\": \"hex_safe_binary_to_term:safe_binary_to_term/1\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/hexpm/hex_core\",\n                    \"vendor\": \"hexpm\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"ebe25d110717f6a3addba5232cd4a7dc1c76b628\",\n                            \"status\": \"affected\",\n                            \"version\": \"fbb6d9de472e5edb8d6fb6b32a91cb266137892e\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"hex","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"cpes\": [\n                        \"cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"mix_hex_repo\",\n                        \"mix_hex_api\"\n                    ],\n                    \"packageName\": \"hex\",\n                    \"packageURL\": \"pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git\",\n                    \"product\": \"hex\",\n                    \"programFiles\": [\n                        \"src/mix_hex_repo.erl\",\n                        \"src/mix_hex_api.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"mix_hex_repo:get_names/1\"\n                        },\n                        {\n                            \"name\": \"mix_hex_repo:get_versions/1\"\n                        },\n                        {\n                            \"name\": \"mix_hex_repo:get_package/2\"\n                        },\n                        {\n                            \"name\": \"mix_hex_repo:get_policy/2\"\n                        },\n                        {\n                            \"name\": \"mix_hex_api:request/4\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/hexpm/hex\",\n                    \"vendor\": \"hexpm\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"2.5.2\",\n                            \"status\": \"affected\",\n                            \"version\": \"2.1.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://github.com","name":"hexpm/hex","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://github.com\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"mix_hex_repo\",\n                        \"mix_hex_api\"\n                    ],\n                    \"packageName\": \"hexpm/hex\",\n                    \"packageURL\": \"pkg:github/hexpm/hex\",\n                    \"product\": \"hex\",\n                    \"programFiles\": [\n                        \"src/mix_hex_repo.erl\",\n                        \"src/mix_hex_api.erl\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"mix_hex_repo:get_names/1\"\n                        },\n                        {\n                            \"name\": \"mix_hex_repo:get_versions/1\"\n                        },\n                        {\n                            \"name\": \"mix_hex_repo:get_package/2\"\n                        },\n                        {\n                            \"name\": \"mix_hex_repo:get_policy/2\"\n                        },\n                        {\n                            \"name\": \"mix_hex_api:request/4\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/hexpm/hex\",\n                    \"vendor\": \"hexpm\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"d8b60eee97abb119d525306f048969a217d793a5\",\n                            \"status\": \"affected\",\n                            \"version\": \"671f695ac548ed01f5828c2a739ecaa942b21007\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":2.1,"severity":"LOW"}],"references":["https://github.com/hexpm/hex_core/security/advisories/GHSA-7c4r-cgf9-9jmq","https://cna.erlef.org/cves/CVE-2026-105274.html","https://osv.dev/vulnerability/EEF-CVE-2026-105274","https://github.com/erlang/rebar3/commit/209c02ec57c2cc3207ee0174c3af3675b8dc8f79","https://github.com/erlang/rebar3/commit/360838a22f5b3a88c0358207f2923059bcbb3afb","https://github.com/hexpm/hex_core/commit/fbb6d9de472e5edb8d6fb6b32a91cb266137892e","https://github.com/hexpm/hex_core/commit/ebe25d110717f6a3addba5232cd4a7dc1c76b628","https://github.com/hexpm/hex/commit/671f695ac548ed01f5828c2a739ecaa942b21007","https://github.com/hexpm/hex/commit/d8b60eee97abb119d525306f048969a217d793a5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105274","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-105274","identifiers":["CVE-2026-105274"]},"retained":false,"historicalAffected":[]}],"coverage":[]}