CVE-2026-21619CWE-400CWE-502

Unsafe Deserialization of Erlang Terms in hex_core

Low · published February 27, 2026

CVSS v4.0
2.0
EPSS
1%
Percentile
48.5
In the wild
Unconfirmed
What it is

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4.

This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.

The record
Technical detail
CVSS v4.0
2.0 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00610 · 48.5th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-502 · Deserialization of Untrusted Data
Published
2026-02-27T17:57Z
EPSS history
Timeline
  • 27 FEB 17:57Z
    Unsafe Deserialization of Erlang Terms in hex_core
    cvelistv5