Vulnerability · Published Feb 27, 2026 · Assigned by EEF
CVE-2026-21619Unsafe Deserialization of Erlang Terms in hex_core
Low 2.0
In plain English
A low-severity uncontrolled resource consumption in rebar3 from erlang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | erlang-hex | no fix listed | DEBIAN-CVE-2026-21619 |
| Debian:14 | erlang-hex | 2.4.2-2 | DEBIAN-CVE-2026-21619 |
| Debian:12 | rebar3 | no fix listed | DEBIAN-CVE-2026-21619 |
| Debian:13 | rebar3 | no fix listed | DEBIAN-CVE-2026-21619 |
| Debian:14 | rebar3 | 3.27.0-1 | DEBIAN-CVE-2026-21619 |
| Ubuntu:22.04:LTS | rebar3 | no fix listed | UBUNTU-CVE-2026-21619 |
| Ubuntu:24.04:LTS | rebar3 | no fix listed | UBUNTU-CVE-2026-21619 |
| Ubuntu:25.10 | rebar3 | no fix listed | UBUNTU-CVE-2026-21619 |
| Ubuntu:26.04:LTS | rebar3 | no fix listed | UBUNTU-CVE-2026-21619 |
| Ubuntu:26.10 | rebar3 | no fix listed | UBUNTU-CVE-2026-21619 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hexpm | hex_core | eb327f8edfe45507351e38cc0805aa12fa647f0b – before cdf726095bca85ad2549d146df1e831ae93c2b13 |
| hexpm | hex_core | 0.1.0 – before 0.12.1 |
| hexpm | hex | 314546ac432229518714cc8e3336e916b9da6305 – before 636739f3322514e9303ca335fb630696fcbb3c95 |
| hexpm | hex | 2.3.0 – before 2.3.2 |
| erlang | rebar3 | 209c02ec57c2cc3207ee0174c3af3675b8dc8f79 – before 1d4478f527e373de0b225951e53115450e0d9b9d |
| erlang | rebar3 | 3.9.1 – before 3.27.0 |
Weakness: CWE-400, CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/hexpm/hex_core/security/advisories/GHSA-hx9w-f2w9-9g96 vendor-advisory, related
- https://cna.erlef.org/cves/CVE-2026-21619.html related
- https://osv.dev/vulnerability/EEF-CVE-2026-21619 related
- https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13 patch
- https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95 patch
- https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d patch