Vulnerability · Published Mar 13, 2026 · Assigned by EEF

CVE-2026-23940Denial of Service via Oversized Package Upload

High 7.1

In plain English

A high-severity uncontrolled resource consumption in hexpm from hexpm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.5%top 59.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality. This issue affects hex.pm: before 2026-03-10.

Affected products (as reported)

Vendor	Product	Versions
hexpm	hexpm	0 – before 2026-03-10
hexpm	hexpm	82911daf5f8fb2ab44f298e3ba22b90bc1ae3746 – before 495f01607d3eae4aed7ad09b2f54f31ec7a7df01

Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/hexpm/hexpm/security/advisories/GHSA-jp8w-gxf6-8hcr vendor-advisory, related
EEF CNA record for CVE-2026-23940 related
OSV record EEF-CVE-2026-23940 related
Introducing commit 82911da in hexpm/hexpm related
Fix commit 495f016 in hexpm/hexpm patch