PT-2026-22367 · Hex+2 · Hex+2

Realcorvus · Published 2026-02-27 · Updated 2026-03-07 · CVE-2026-21619

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions hex core versions 0.1.0 through 0.12.0 hex versions 2.3.0 through 2.3.1 rebar3 versions 3.9.1 through 3.26.9

Description An issue exists in hex core, hex, and rebar3 related to uncontrolled resource consumption and deserialization of untrusted data. This can lead to object injection and excessive allocation. The issue is present in the following program files: src/hex api.erl, src/mix hex api.erl, and apps/rebar/src/vendored/r3 hex api.erl. The following program routines are affected: hex core:request/4, mix hex api:request/4, and r3 hex api:request/4.

Recommendations hex core versions prior to 0.12.1 hex versions prior to 2.3.2 rebar3 versions prior to 3.27.0

Fix

Resource Exhaustion

Deserialization of Untrusted Data

Weakness Enumeration

CWE-400

CWE-502

Related Identifiers

CVE-2026-21619

GHSA-HX9W-F2W9-9G96

Affected Products

Hex

Hex Core

Rebar3

References · 19

• https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d · Patch
• https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95 · Patch
• https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13 · Patch
• https://github.com/hexpm/hex_core/security/advisories/GHSA-hx9w-f2w9-9g96 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21619 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21619 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hx9w-f2w9-9g96 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-21619 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-21619 · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-21619 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21619 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-21619 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21619 · Vendor Advisory
• https://github.com/hexpm/hex_core · Note
• https://twitter.com/CVEnew/status/2027466591588553128 · Twitter Post