CVE-2026-21619
- Source
- https://cve.org/CVERecord?id=CVE-2026-21619
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21619.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-21619
- Aliases
- Downstream
- Published
- 2026-02-27T18:16:11.373Z
- Modified
- 2026-03-03T01:22:47.823278Z
- Severity
-
- 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- [none]
- Details
-
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hexcore (hexapi modules), hexpm hex (mixhexapi modules), erlang rebar3 (r3hexapi modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hexapi.erl, src/mixhexapi.erl, apps/rebar/src/vendored/r3hexapi.erl and program routines hexcore:request/4, mixhexapi:request/4, r3hexapi:request/4.
This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
- References
-
- https://github.com/hexpm/hex_core/security/advisories/GHSA-hx9w-f2w9-9g96
- https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d
- https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95
- https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13
Affected packages
Git / github.com/erlang/rebar3
Affected ranges
- Type
- GIT
- Repo
- https://github.com/erlang/rebar3
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixed
Git / github.com/hexpm/hex
Affected ranges
- Type
- GIT
- Repo
- https://github.com/hexpm/hex
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixed
Affected versions
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.10.0
v0.10.2
v0.10.3
v0.10.4
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.11.4
v0.11.5
v0.12.0
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.6.0
v0.6.1
v0.6.2
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.9.0
v2.*
v2.3.0
v2.3.1
Git / github.com/hexpm/hex_core
Affected ranges
- Type
- GIT
- Repo
- https://github.com/hexpm/hex_core
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixed