Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member.
When erl_tar:extract/1,2 writes a member to disk, erl_tar:stream_to_file_loop/3 reads it in chunks of 65536 bytes by default. For a GNU sparse member whose sparse map ends before its real size, erl_tar:do_sparse_read/3 matches its trailing-hole clause before its zero-length clause. After the chunk is used up, the trailing-hole clause reads zero bytes, does not advance the position, and recurses forever. A 2048-byte archive keeps the extracting process and one scheduler busy until the process is killed. The {max_size, N} option prevents this only when N is below the real size of the member. Extraction with the memory option is not affected.
hex_core ships its own copy of erl_tar as hex_erl_tar, and Hex and rebar3 ship hex_core with prefixed module names (mix_hex_erl_tar and r3_hex_erl_tar). These copies contain the same code and do not call stdlib's erl_tar, so they are affected on any OTP version. OTP 28 is not affected, but an application running on OTP 28 is affected if it extracts archives through an affected version of hex_core, Hex or rebar3.
This issue affects OTP from OTP 29.0 before OTP 29.1.2, corresponding to rebar3 from 3.27.1 before 3.28.0, and stdlib from 8.0 before 8.1.1, and hex from 2.4.2 before 2.5.3; hex_core: from 0.14.0 before 0.20.1.
CVE-2026-105274 is a low severity vulnerability in Erlang's rebar3, hex, and hex_core components involving improper handling of highly compressed data. An untrusted repository mirror or server can send a small compressed response that decompresses into a very large data structure, exhausting the Erlang VM memory before signature verification. This occurs because decompression and decoding steps do not limit the size of the decompressed or decoded data. The vulnerability affects rebar3 versions from 3.9.1 up to but not including 3.27.3, hex from 2.1.0 up to but not including 2.5.2, and hex_core from 0.1.0 up to but not including 0.20.0.
CVE-2026-81856 is a low-severity vulnerability in hexpm hex versions from 0.0.1 up to but not including 2.5.2. It involves improper neutralization of escape, meta, or control sequences, allowing a malicious package publisher or hostile repository server to inject terminal control sequences into the output of Mix tasks. This can lead to forged terminal output, concealed real output, or clipboard writes without requiring authentication or privileged access.
CVE-2026-96612 is a path traversal vulnerability in hexpm hex affecting versions from 0.6.0 up to but not including 2.5.2. It allows a malicious package publisher to specify a crafted application label that causes the dependency management process to delete and overwrite directories outside the intended deps directory. This occurs because hex does not validate the app label properly and uses it directly to determine the directory path for unpacking packages. The vulnerability can lead to arbitrary directory deletion and file overwriting during dependency fetching or updating.
CVE-2026-105668 is a Protection Mechanism Failure vulnerability in hexpm hex versions 2.5.0 up to but not including 2.5.2. It allows a package owner or an attacker who has compromised the owner's account to bypass the release-age cooldown mechanism, enabling a newly published release to be selected during dependency resolution despite being younger than the configured cooldown period. This bypass occurs because the cooldown bypass check is based solely on package name, affecting packages with the same name across repositories. The vulnerability does not affect cooldowns configured through organization dependency policies.
CVE-2026-105280 is a medium severity vulnerability in hexpm hex affecting versions from 0.20.2 up to but not including 2.5.2. It involves improper validation of integrity check values when fetching packages with the command mix hex.package fetch using standard output. This flaw allows a malicious package mirror to substitute altered tarball data that is written to standard output without checksum verification, potentially leading to untrusted content being processed. The vulnerability arises because the standard output branch bypasses the checksum comparison that is otherwise enforced when writing to a file. Additionally, error responses containing tar archives can be written to standard output before checksum verification, enabling extraction of untrusted files if the output is piped to an unpacking tool.
CVE-2026-96618 is a low severity vulnerability in hexpm hex affecting versions from 0.11.2 up to but not including 2.5.2. It involves improper handling of highly compressed data that can lead to excessive memory or disk space consumption when using commands like mix deps.get, mix deps.update, mix hex.package fetch, or mix hex.docs fetch. The vulnerability arises because hex processes untrusted mirrors without limiting the size of compressed or decompressed data, allowing a malicious mirror to cause resource exhaustion. This affects registry, package, docs, and API responses, with some paths lacking size limits or checksum verification. No known exploits are reported, and no official patch information is provided in the input data.
CVE-2026-103503 is an improper certificate validation vulnerability in hexpm hex affecting versions from 0.20.2 up to but not including 2.5.2. The issue arises when the software uses a custom CA certificate store (cacerts_path) that excludes a CA present in Hex's bundled CA store. The verification logic incorrectly accepts server certificate chains containing certificates with public keys matching those in the bundled CA store, even if the configured CA store does not trust that CA. Hostname verification remains enforced. This flaw could allow an attacker who intercepts HTTPS connections and possesses a certificate issued by a CA in the bundled store to impersonate a Hex host to users relying on a custom CA store that excludes that CA.
CVE-2026-32148 is a high-severity vulnerability in hexpm hex affecting versions from 0.16.0 before 2.4.2. It involves improper validation of dependency integrity checks due to a type mismatch in the verification logic, causing checksum verification to be skipped silently. This allows an attacker who can influence cached packages or a compromised registry to inject modified dependencies without detection. The mix.lock file is overwritten with attacker-controlled checksum values, erasing evidence of tampering. No official patch or remediation guidance is currently confirmed.
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4.
This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.