This vulnerability involves uncontrolled resource consumption and deserialization of untrusted data in hexpm's hex_core (hex_api modules), hex (mix_hex_api modules), and erlang rebar3 (r3_hex_api modules). The issue allows object injection and excessive memory allocation through the affected request functions (hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4). It impacts versions of hex_core from 0.1.0 up to but not including 0.12.1, hex from 2.3.0 up to but not including 2.3.2, and rebar3 from 3.9.1 up to but not including 3.27.0. The CVSS 4.0 base score is 2.0, indicating low severity, with network attack vector, low attack complexity, and partial privileges required.

The vulnerability could allow an attacker with some privileges and user interaction to cause excessive resource consumption or object injection, potentially leading to denial of service or other stability issues. There is no indication of confidentiality, integrity, or availability impact beyond resource exhaustion. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to hex_core version 0.12.1 or later, hex version 2.3.2 or later, and rebar3 version 3.27.0 or later once official patches are available. Until then, limit exposure by restricting access to affected components and avoid processing untrusted data through the vulnerable APIs.