PT-2026-25321 · Hexpm+2 · Hex.Pm+1

Jzakharia1 · Published 2026-03-13 · Updated 2026-03-14 · CVE-2026-23940

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions hexpm versions prior to 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 hex.pm versions prior to 2026-03-10

Description An uncontrolled resource consumption issue in hexpm allows for excessive allocation. Publishing an oversized package can cause Hex.pm to exhaust memory during the extraction of the uploaded package’s tarball. This can terminate the affected application instance, leading to a denial of service for package publishing and potentially other package-processing functionalities.

Recommendations Versions prior to 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 should be updated. Versions prior to 2026-03-10 should be updated.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-23940

GHSA-JP8W-GXF6-8HCR

Affected Products

Hex.Pm

Hexpm

References · 6

• https://github.com/hexpm/hexpm/commit/495f01607d3eae4aed7ad09b2f54f31ec7a7df01 · Patch
• https://github.com/hexpm/hexpm/security/advisories/GHSA-jp8w-gxf6-8hcr · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-23940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23940 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23940 · Vendor Advisory
• https://twitter.com/CVEnew/status/2032831375758471502 · Twitter Post