CVE-2026-103503

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103503
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103503.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103503
Aliases
Published
2026-10-12T15:17:45Z
Modified
2026-10-14T02:46:07Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Hex trusts its bundled CA certificates when cacerts_path is set
Details

Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out.

cacerts_path (HEX_CACERTS_PATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.ssl_opts/1 passes the configured store as the cacerts option, but builds the partial_chain callback from the bundled store whether cacerts_path is set or not. Hex.HTTP.SSL.partial_chain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies.

This issue affects hex: from 0.20.2 before 2.5.2.

Database specific 
{
    "cna_assigner":  "EEF",
    "cwe_ids":  [
        "CWE-295"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103503.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "0.20.2"
                },
                {
                    "fixed":  "2.5.2"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/hexpm/hex

Affected ranges

Type
GIT
Repo
https://github.com/hexpm/hex
Events
Introduced
c9b26a46928bfcd546773571e09c1d05f4cd9fb7
Fixed
5f5a2136c7cf5991b6e8a30d645ca9f8e74b0785
Fixed
6232a6498015e559743bec4f4fbec9138837cec8
Fixed
c9b26a46928bfcd546773571e09c1d05f4cd9fb7
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103503.json"