Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

hex_core

5 known vulnerabilities (2 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 2 medium, 2 low
Registry
Hex

Advisories 5

  • CVE-2026-96596Medium 5.9

    erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

    Affected: from 0.14.0, fixed in 0.20.1.

  • hex_core decompresses registry and Erlang term API responses without size limits

    Affected: from 0.1.0, fixed in 0.20.0.

  • CVE-2026-103502Medium 5.9

    hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

    Affected: from 0.1.0, fixed in 0.20.0.

  • Unsafe Deserialization of Erlang Terms in hex_core

    Affected: from 0.1.0, fixed in 0.12.1; fixed in 0.12.1; from 0.1.0, fixed in 0.12.1.

  • Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can…

    Affected: fixed in 0.4.0.