# hex\_core (Hex) vulnerabilities

5 known vulnerabilities (2 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://hex.pm/packages/hex_core

## Advisories (5)

### [CVE-2026-96596](https://cve.now/CVE-2026-96596): erl\_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

- Severity: Medium 5.9
- Published: Oct 14, 2026
- Affected: from 0.14.0, fixed in 0.20.1.

### [CVE-2026-105274](https://cve.now/CVE-2026-105274): hex\_core decompresses registry and Erlang term API responses without size limits

- Severity: Low 2.1
- Published: Oct 12, 2026
- Affected: from 0.1.0, fixed in 0.20.0.

### [CVE-2026-103502](https://cve.now/CVE-2026-103502): hex\_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

- Severity: Medium 5.9
- Published: Oct 12, 2026
- Affected: from 0.1.0, fixed in 0.20.0.

### [CVE-2026-21619](https://cve.now/CVE-2026-21619): Unsafe Deserialization of Erlang Terms in hex\_core

- Severity: Low 2.0
- Published: Feb 27, 2026
- Affected: from 0.1.0, fixed in 0.12.1; fixed in 0.12.1; from 0.1.0, fixed in 0.12.1.

### [CVE-2019-1000013](https://cve.now/CVE-2019-1000013): Hex package manager hex\_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can…

- Severity: Unrated
- Published: Feb 4, 2019
- Affected: fixed in 0.4.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/hex/hex_core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.