EEF-CVE-2026-23940

See a problem?
Please try reporting it to the source first.
Source
https://cna.erlef.org/osv/EEF-CVE-2026-23940.html
Import Source
https://cna.erlef.org/osv/EEF-CVE-2026-23940.json
JSON Data
https://api.osv.dev/v1/vulns/EEF-CVE-2026-23940
Aliases
Published
2026-03-13T16:07:53.328Z
Modified
2026-03-17T04:00:18.548Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Denial of Service via Oversized Package Upload
Details

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality.

This issue affects hexpm: before 495f01607d3eae4aed7ad09b2f54f31ec7a7df01; hex.pm: before 2026-03-10.

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "cpe_ids": [
        "cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
    ],
    "capec_ids": [
        "CAPEC-130"
    ]
}
References
Credits
    • Joud Zakharia / zentrust partners GmbH - FINDER
    • Eric Meadows-Jönsson / Hex.pm - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/hexpm/hexpm.git

Affected ranges

Type
GIT
Repo
https://github.com/hexpm/hexpm.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
495f01607d3eae4aed7ad09b2f54f31ec7a7df01

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-23940.json"