CVE-2026-105274: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) in erlang rebar3

This vulnerability (CVE-2026-105274) involves improper handling of highly compressed data in the Erlang hexpm hex_core library and related tools (hex and rebar3). The affected functions decompress registry responses using zlib:gunzip/1 and decode signed envelopes before verifying signatures. Because the decompression occurs before signature verification, a malicious mirror can send a small compressed payload that expands into a very large envelope, causing memory exhaustion (data amplification). Additionally, the decoding uses binary_to_term with the safe option, which prevents atom creation but still allows decompression of terms without size limits, enabling large memory consumption before rejecting unsafe terms. The vulnerability affects rebar3 versions >=3.9.1, hex versions >=2.1.0 and <2.5.2, and hex_core versions >=0.1.0 and <0.20.0.

An attacker controlling an untrusted repository mirror or a server responding to hex_core API requests can cause the Erlang VM running hex_core to exhaust memory by sending a small compressed response that decompresses into a very large data structure. This can lead to denial of service due to resource exhaustion. There is no indication of code execution or data corruption. The impact is limited to resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch links were provided, users should monitor for vendor updates addressing this vulnerability. Until a fix is available, avoid using untrusted repository mirrors or servers for hex_core, hex, and rebar3 API requests to mitigate risk.