GHSA-hx9w-f2w9-9g96

Suggest an improvement
Source
https://github.com/advisories/GHSA-hx9w-f2w9-9g96
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-hx9w-f2w9-9g96/GHSA-hx9w-f2w9-9g96.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hx9w-f2w9-9g96
Aliases
Published
2026-03-01T01:25:35Z
Modified
2026-04-06T23:34:56.174182Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
hex_core has Unsafe Deserialization of Erlang Terms
Details

Impact

The Hex client (hex_core) deserializes Erlang terms received from the Hex API using binary_to_term/1 without sufficient restrictions.

If an attacker can control the HTTP response body returned by the Hex API, this allows denial-of-service attacks such as atom table exhaustion, leading to a VM crash. No released versions are known to allow remote code execution.

Patches

  • https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13
  • https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95
  • https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d

Workarounds

Ensure that the Hex API URL (HEX_API_URL) points only to trusted endpoints. There is no client-side workaround that fully mitigates this issue without applying the patch.

Resources

  • hexcore Module: https://github.com/hexpm/hexcore/blob/main/src/hex_api.erl
  • Hex Vendored Module: https://github.com/hexpm/hex/blob/main/src/mixhexapi.erl
  • Rebar3 Vendored Module: https://github.com/erlang/rebar3/blob/main/apps/rebar/src/vendored/r3hexapi.erl
  • hexcore Patch: https://github.com/hexpm/hexcore/commit/cdf726095bca85ad2549d146df1e831ae93c2b13
  • Hex Vendored Patch: https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95
  • Rebar3 Vendored Patch: https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d
Database specific 
{
    "nvd_published_at": "2026-02-27T18:16:11Z",
    "severity": "LOW",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed_at": "2026-03-01T01:25:35Z"
}
References

Affected packages

Hex / hex_core

Package

Name
hex_core
Purl
pkg:hex/hex_core

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.12.1

Affected versions

0.*
0.1.0
0.1.1
0.2.0
0.2.1
0.3.0
0.4.0
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.6.10
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.10.0
0.10.1
0.10.2
0.10.3
0.11.0
0.12.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-hx9w-f2w9-9g96/GHSA-hx9w-f2w9-9g96.json"