This vulnerability involves uncontrolled resource consumption and deserialization of untrusted data in hexpm's hex_core (hex_api modules), hex (mix_hex_api modules), and erlang rebar3 (r3_hex_api modules). The affected program files include src/hex_api.erl, src/mix_hex_api.erl, and apps/rebar/src/vendored/r3_hex_api.erl, specifically in the request/4 functions of these modules. Versions impacted are hex_core from 0.1.0 up to but not including 0.12.1, hex from 2.3.0 up to but not including 2.3.2, and rebar3 from 3.9.1 up to but not including 3.27.0. The vulnerability allows object injection and excessive memory allocation due to improper handling of deserialized data, potentially leading to resource exhaustion. The CVSS 4.0 vector indicates network attack vector, low complexity, partial privileges required, user interaction needed, and low impact on confidentiality, integrity, and availability.

The vulnerability can cause excessive resource consumption and object injection through deserialization of untrusted data, potentially leading to denial of service conditions. However, the CVSS score of 2 and the low severity rating indicate limited impact. There are no reports of known exploits in the wild, suggesting low current risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's security advisories for updates. Until a fix is available, cautious handling of untrusted data inputs to the affected modules is advisable to reduce risk.