CVE-2026-96618Published
Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-96618 · Microsoft / collected KEV context
cve-program · CVE-2026-96618
- https://github.com/hexpm/hex/security/advisories/GHSA-gf42-pg2f-63jp
- https://cna.erlef.org/cves/CVE-2026-96618.html
- https://osv.dev/vulnerability/EEF-CVE-2026-96618
- https://github.com/hexpm/hex/commit/51ea632424fb6ea8765148f96dc25dfeb526b1f8
- https://github.com/hexpm/hex/commit/bb5189eade682c5fc3f98d9725973a7beb4e1deb
- https://github.com/hexpm/hex/commit/08956100a8283ba500a123e5539ac64d5d7e91d8
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.