Threats Tagged 'cve-2026-103502'

An improper certificate validation vulnerability exists in hexpm's hex_core library affecting versions before 0.20.0. This flaw allows an attacker who can intercept HTTPS connections to impersonate hex.pm or related repositories when using hex_core's default HTTP adapter on Erlang/OTP 24 or OTP 25 without a loaded CA certificate store. The issue arises because the default HTTP adapter falls back to insecure SSL options that do not verify server certificates in these environments. hex_core 0.11.0 and later added secure SSL defaults for OTP 25+, but earlier versions remain vulnerable. The vulnerability is documented but the warnings and README do not clearly communicate the lack of certificate verification under certain conditions.

CVE-2026-103502 is an improper certificate validation vulnerability in the hexpm hex_core library affecting versions from 0.1.0 up to but not including 0.20.0. It allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm, or other repository/API servers when using hex_core's default HTTP adapter on Erlang/OTP 24 or OTP 25 if the OS CA certificates cannot be loaded. This occurs because the default HTTP adapter falls back to insecure SSL options that do not verify server certificates in these environments. The issue was addressed in hex_core 0.11.0 by enabling secure SSL defaults for OTP 25 and later. The vulnerability has a CVSS 4.0 score of 5.9 (medium severity).