Vulnerability · Published Oct 12, 2026 · Assigned by EEF

CVE-2026-103503Hex trusts its bundled CA certificates when cacerts_path is set

Medium 5.9

In plain English

A medium-severity improper certificate validation in hex from hexpm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.9Medium

Exploit odds (30 days)0.2%top 89.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out. cacerts_path (HEX_CACERTS_PATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.ssl_opts/1 passes the configured store as the cacerts option, but builds the partial_chain callback from the bundled store whether cacerts_path is set or not. Hex.HTTP.SSL.partial_chain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies. This issue affects hex: from 0.20.2 before 2.5.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	erlang-hex	no fix listed	DEBIAN-CVE-2026-103503
Debian:14	erlang-hex	2.5.3-2	DEBIAN-CVE-2026-103503
Ubuntu:24.04:LTS	erlang-hex	no fix listed	UBUNTU-CVE-2026-103503
Ubuntu:26.04:LTS	erlang-hex	no fix listed	UBUNTU-CVE-2026-103503
Ubuntu:26.10	erlang-hex	no fix listed	UBUNTU-CVE-2026-103503

Affected products (as reported)

Vendor	Product	Versions
hexpm	hex	0.20.2 – before 2.5.2
hexpm	hex	c9b26a46928bfcd546773571e09c1d05f4cd9fb7 – before *

Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

GitHub Advisory related, vendor-advisory
EEF CNA record for CVE-2026-103503 related
OSV record EEF-CVE-2026-103503 related
Introducing commit c9b26a4 in hexpm/hex related
Fix commit 5f5a213 in hexpm/hex patch
Fix commit 6232a64 in hexpm/hex patch