CVE-2026-103502: CWE-295 Improper Certificate Validation in hexpm hex_core

The vulnerability arises from hex_core's default HTTP adapter (hex_http_httpc) which, on Erlang/OTP 24 or OTP 25 without accessible CA certificates, sends HTTPS requests without verifying server certificates. This fallback behavior is due to public_key:cacerts_get/0 raising an error or being unavailable, causing the adapter to omit SSL verification options. Versions of hex_core before 0.11.0 never set SSL options, resulting in no certificate verification on OTP 25 and earlier regardless of CA store presence. Although warnings and documentation mention insecure defaults, they do not clearly state that server certificates are not verified, potentially misleading users. The issue affects hex_core versions >=0.1.0 and <0.20.0 and was fixed by adding secure SSL defaults starting with version 0.11.0.

An attacker capable of intercepting HTTPS connections can impersonate hex.pm, repo.hex.pm, or other API servers to clients using vulnerable hex_core versions on OTP 24 or OTP 25 without CA certificates. This can lead to man-in-the-middle attacks where the client accepts fraudulent server certificates, undermining the authenticity and confidentiality of communications. The vulnerability does not require privileges or authentication but does require network interception capability.

Users should upgrade hex_core to version 0.20.0 or later, where secure SSL defaults are enforced, including certificate verification on OTP 25 and later. For OTP 24 or OTP 25 environments without CA certificates, ensure that CA stores are properly installed and accessible to avoid fallback to insecure SSL options. The advisory notes that the issue was fixed starting with hex_core 0.11.0 by enabling secure SSL defaults. No other specific mitigations are indicated.