CVE-2026-23940CWE-400denial-of-service

CVE-2026-23940

Medium · published March 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation.

Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality.

This issue affects hex.pm: before 2026-03-10.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00457 · 38.6th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-03-13T23:54Z
Affected products (1)
ProductVersionsFixed in
hex/hexpm< 2026-03-092026-03-09
References (5)
https://cna.erlef.org/cves/CVE-2026-23940.html · 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/hexpm/hexpm/commit/495f01607d3eae4aed7ad09b2f54f31ec7a7df01 · 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/hexpm/hexpm/commit/82911daf5f8fb2ab44f298e3ba22b90bc1ae3746 · 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/hexpm/hexpm/security/advisories/GHSA-jp8w-gxf6-8hcr · 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://osv.dev/vulnerability/EEF-CVE-2026-23940 · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
EPSS history
Timeline
  • 13 MAR 16:07Z
    Denial of Service via Oversized Package Upload
    cvelistv5