PT-2026-25321 · Hexpm+2 · Hex.Pm+1

Jzakharia1 · Publicado 2026-03-13 · Atualizado 2026-03-14 · CVE-2026-23940

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions hexpm versions prior to 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 hex.pm versions prior to 2026-03-10

Description An uncontrolled resource consumption issue in hexpm allows for excessive allocation. Publishing an oversized package can cause Hex.pm to exhaust memory during the extraction of the uploaded package’s tarball. This can terminate the affected application instance, leading to a denial of service for package publishing and potentially other package-processing functionalities.

Recommendations Versions prior to 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 should be updated. Versions prior to 2026-03-10 should be updated.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2026-23940

GHSA-JP8W-GXF6-8HCR

Produtos afetados

Hex.Pm

Hexpm

Referências · 6

• https://github.com/hexpm/hexpm/commit/495f01607d3eae4aed7ad09b2f54f31ec7a7df01 · Correção
• https://github.com/hexpm/hexpm/security/advisories/GHSA-jp8w-gxf6-8hcr · Aviso do Fabricante
• https://osv.dev/vulnerability/EEF-CVE-2026-23940 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-23940 · Nota de Segurança
• https://twitter.com/CVEnew/status/2032831375758471502 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23940 · Aviso do Fabricante