CVE-2026-96618: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) in hexpm hex

The vulnerability in hexpm hex (CVE-2026-96618) is due to improper handling of highly compressed data, leading to potential data amplification attacks. When hex fetches packages, registry data, or documentation from an untrusted mirror, it decompresses gzip-encoded responses fully into memory without limits before verifying their authenticity. Package tarballs have no download size limit and are held in memory or streamed to disk before unpacking and checksum verification. Documentation tarballs are written to disk and extracted without size limits or signature verification, increasing risk. This allows an untrusted mirror to cause memory or disk exhaustion on the client machine running mix commands such as deps.get, deps.update, hex.package fetch, or hex.docs fetch. The issue affects hex versions >=0.11.2 and <2.5.2.

An attacker controlling an untrusted package mirror can cause denial of service by exhausting memory or disk space on the client machine running hex commands. This can disrupt development workflows but does not allow code execution or privilege escalation. The vulnerability is limited to resource exhaustion and does not compromise integrity due to signature and checksum checks occurring after decompression for most data, except documentation tarballs which lack signature verification.

A fix is available in hex version 2.5.2 and later. Users should upgrade to 2.5.2 or newer to mitigate this vulnerability. Until then, avoid configuring untrusted mirrors or ensure mirrors are trusted and properly secured. There is no indication that the vendor considers this issue already mitigated without upgrade. Patch status is confirmed by the version range affected and fixed in 2.5.2.