Hex package vulnerabilities
The newest vulnerabilities affecting Hex packages, up to 200. Subscribe by RSS.
- CVE-2026-109823Host filesystem path disclosure via DNS rebindingtidewave-ai tidewave · tidewave
- CVE-2026-65630Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in josepotatosalad jose · jose
- CVE-2026-65632ECDSA signature length is not validated in jose, allowing signature malleabilitypotatosalad jose · jose
- CVE-2026-65631erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of servicepotatosalad jose · jose
- CVE-2026-65629Weak PBKDF2 parameters for password-encrypted private-key export in josepotatosalad jose · jose
- CVE-2026-65628Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key typespotatosalad jose · jose
- CVE-2026-65627Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2potatosalad jose · jose
- CVE-2026-65626Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in josepotatosalad jose · jose
- CVE-2026-65625Attacker-controlled AES-GCM authentication tag length allows tag forgery in josepotatosalad jose · jose
- CVE-2026-115627AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rowsash-project ash_postgres · ash_postgres
- CVE-2026-115635AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is setash-project ash_postgres · ash_postgres
- CVE-2026-114214Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination recordsash-project ash · ash
- CVE-2026-107685WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackersagentjido req_llm · req_llm
- CVE-2026-105963Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto argumentselixir-plug plug · elixir-plug plug_crypto +2
- CVE-2026-93471Unbounded SAML message decompression in esaml allows memory exhaustionhandnot2 esaml · arekinath esaml +2
- CVE-2026-86696Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustionhandnot2 esaml · arekinath esaml +2
- CVE-2026-105270Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustionarekinath esaml · handnot2 esaml +2
- CVE-2026-105660Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Banditmtrudel bandit · bandit
- CVE-2026-96596erl_tar:extract/2 loops forever on a GNU sparse member with a trailing holeerlang rebar3 · hexpm hex_core +3
- CVE-2026-105659HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Banditmtrudel bandit · bandit
- CVE-2026-105274hex_core decompresses registry and Erlang term API responses without size limitserlang rebar3 · hexpm hex_core +2
- CVE-2026-103502hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25hexpm hex_core · hex_core
- CVE-2026-105283Internal error terms inspected into AshTypescript RPC error responsesash-project ash_typescript · ash_typescript
- CVE-2026-97853Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoSericmj decimal · decimal
- CVE-2026-104635Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messageselixir-protobuf protobuf · protobuf
- CVE-2026-101028Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sortsash-project ash · ash
- CVE-2026-104634beam_mcp: JSON boolean and null tool arguments reach dispatch as stringsScriptKittyOS beam_mcp · beam_mcp
- CVE-2026-88257beam_mcp: nested tool argument constraints advertised but not enforcedScriptKittyOS beam_mcp · beam_mcp
- CVE-2026-94206Cloak PBKDF2 field ignores the configured iteration count and runs only :size roundsdanielberkompas cloak_ecto · danielberkompas cloak +2
- CVE-2026-95105Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flippingdanielberkompas cloak · cloak
- CVE-2026-94201Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ashash-project ash · ash
- CVE-2026-94194Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediarieselixir-mint mint · mint
- CVE-2026-92103Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_sizeelixir-mint mint · mint
- CVE-2026-91043HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memoryelixir-mint mint · mint
- CVE-2026-92106lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSSdashbitco lazy_html · lazy_html
- CVE-2026-93477Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ashash-project ash · ash
- CVE-2026-91187Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategydashbit nimble_zta · nimble_zta
- CVE-2026-82723Actor record with password digest stored in AshAuthentication audit log entriesteam-alembic ash_authentication · ash_authentication
- CVE-2026-56813Cookie attribute injection in Plug.Conn.Cookies.encode/2elixir-plug plug · plug
- CVE-2026-56814Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)elixir-plug plug · plug
- CVE-2026-56812Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiffphoenixframework phoenix · phoenix
- CVE-2026-56811Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of servicephoenixframework phoenix · phoenix
- CVE-2026-54893Email-derived URL path injection in the Swoosh Microsoft Graph adapterswoosh
- CVE-2026-48853Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpcelixir-grpc grpc · grpc
- CVE-2026-48599Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcodingelixir-grpc grpc · grpc
- CVE-2026-48854Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpcelixir-grpc grpc · grpc
- CVE-2026-43966HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2ninenines cowlib · cowlib +2
- CVE-2026-48596CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injectionelixir-tesla tesla · tesla
- CVE-2026-48594Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compressionelixir-tesla tesla · tesla
- CVE-2026-48595Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirectselixir-tesla tesla · tesla
- CVE-2026-48597Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mintelixir-tesla tesla · tesla
- CVE-2026-48598CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injectionelixir-tesla tesla · tesla
- CVE-2026-43969Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1ninenines cowlib · cowlib
- CVE-2025-68113ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replayaltcha-org altcha-lib · altcha-lib +4
- CVE-2021-46871tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.phoenix_html