CVE-2026-23940

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23940
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23940.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-23940
Aliases
Published
2026-03-13T19:54:14.640Z
Modified
2026-04-02T13:13:26.335215Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality.

This issue affects hexpm: before 495f01607d3eae4aed7ad09b2f54f31ec7a7df01; hex.pm: before 2026-03-10.

References

Affected packages

Git / github.com/hexpm/hexpm

Affected ranges

Type
GIT
Repo
https://github.com/hexpm/hexpm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
495f01607d3eae4aed7ad09b2f54f31ec7a7df01

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23940.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "2026-03-09"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "495f01607d3eae4aed7ad09b2f54f31ec7a7df01"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "2026-03-10"
            }
        ]
    }
]