CVE-2026-21619

LOW EPSS 43.2%
Published Feb 27, 20264mo ago · Modified Apr 6, 20262mo ago
2.0 CVSS 4.0
Low
Find Similar
Published Feb 27, 2026 4mo ago
Last Modified Apr 6, 2026 2mo ago

Description

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.

CVSS Details

Base Score
2.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
43.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-400 Uncontrolled Resource Consumption Resource Mgmt
CWE-502 Deserialization of Untrusted Data Validation

Affected Products 3

VendorProductVersionRange
erlangrebar3*≥3.9.1  –  <3.27.0
hexhex*≥2.3.0  –  <2.3.2
hexhex_core*≥0.1.0  –  <0.12.1

References 6

  • cna.erlef.org https://cna.erlef.org/cves/CVE-2026-21619.html
  • github.com https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d
    Patch
  • github.com https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95
    Patch
  • github.com https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13
    Patch
  • github.com https://github.com/hexpm/hex_core/security/advisories/GHSA-hx9w-f2w9-9g96
    MitigationVendor Advisory
  • osv.dev https://osv.dev/vulnerability/EEF-CVE-2026-21619

Remediation

  • github.com https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d
    Patch
  • github.com https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95
    Patch
  • github.com https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13
    Patch