CVE-2026-21619

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Feb 27, 2026
Source updated: May 27, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Unsafe Deserialization of Erlang Terms in hex_core

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

hex_core

Vendor: hexpm
Product: hex_core
Platforms: Unknown
Default status: unaffected
Package: hexpm/hex_core
Package collection: https://github.com

hex_core · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
eb327f8edfe45507351e38cc0805aa12fa647f0b	`affected`	git	cdf726095bca85ad2549d146df1e831ae93c2b13	Unavailable	None listed

hex_core

Vendor: hexpm
Product: hex_core
Platforms: Unknown
Default status: unaffected
Package: hex_core
Package collection: https://repo.hex.pm

hex_core · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.1.0	`affected`	semver	0.12.1	Unavailable	None listed

hex

Vendor: hexpm
Product: hex
Platforms: Unknown
Default status: unaffected
Package: hexpm/hex
Package collection: https://github.com

hex · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
314546ac432229518714cc8e3336e916b9da6305	`affected`	git	636739f3322514e9303ca335fb630696fcbb3c95	Unavailable	None listed

hex

Vendor: hexpm
Product: hex
Platforms: Unknown
Default status: unaffected
Package: hex

hex · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.3.0	`affected`	semver	2.3.2	Unavailable	None listed

rebar3

Vendor: erlang
Product: rebar3
Platforms: Unknown
Default status: unaffected
Package: erlang/rebar3
Package collection: https://github.com

rebar3 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
209c02ec57c2cc3207ee0174c3af3675b8dc8f79	`affected`	git	1d4478f527e373de0b225951e53115450e0d9b9d	Unavailable	None listed

rebar3

Vendor: erlang
Product: rebar3
Platforms: Unknown
Default status: unaffected
Package: rebar3
Package collection: https://github.com

rebar3 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.9.1	`affected`	semver	3.27.0	Unavailable	None listed