PT-2026-55926 · Hexpm · Hpax

Andrea Leopardi + 2 · Published 2026-07-06 · Updated 2026-07-06 · CVE-2026-58226

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions hpax versions 0.1.1 through 1.0.3

Description An inefficient algorithmic complexity issue exists during the decoding of HPACK variable-length integers. The Elixir.HPAX.Types:decode remaining integer/3 function, accessed via the Elixir.HPAX:decode/2 entry point, does not impose an upper bound on the decoded value or the number of continuation octets. Since BEAM integers use arbitrary precision, a sequence of continuation octets creates an O(N)-bit bignum, resulting in a superlinear decoding cost of approximately O(N^2). An unauthenticated attacker can exploit this by sending a small HTTP/2 header block that consumes excessive CPU and transient memory, leading to a denial-of-service amplification.

Recommendations Update hpax to version 1.0.4 or later.

Exploit

Fix

Weakness Enumeration

CWE-407

Related Identifiers

CVE-2026-58226

GHSA-JJ2P-32J7-WHJ2

Affected Products

Hpax

References · 6

• 🔥 https://github.com/elixir-mint/hpax/security/advisories/GHSA-jj2p-32j7-whj2 · Exploit
• https://github.com/elixir-mint/hpax/commit/1ba4bb2dc91e80089cf89c73970ac3ded76f17eb · Patch
• https://osv.dev/vulnerability/EEF-CVE-2026-58226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-58226 · Security Note
• https://hex.pm/packages/hpax · Note
• https://cna.erlef.org/cves/CVE-2026-58226.html · Note