CVE-2026-21619: Hex Core DoS Vulnerability

CVE-2026-21619 Overview

CVE-2026-21619 is an Insecure Deserialization and Uncontrolled Resource Consumption vulnerability affecting the Hex package management ecosystem used by Elixir and Erlang developers. The vulnerability exists in hex_core, hex, and rebar3 build tools, specifically in API request handling routines that process untrusted data from remote sources.

The flaw allows attackers to potentially perform Object Injection and Excessive Allocation attacks through the deserialization of untrusted data in the hex_api.erl, mix_hex_api.erl, and r3_hex_api.erl program files. The affected routines include hex_core:request/4, mix_hex_api:request/4, and r3_hex_api:request/4.

Critical Impact

Attackers can exploit unsafe deserialization in Hex package manager API modules to inject objects or cause resource exhaustion through excessive memory allocation, potentially impacting build pipelines and development environments.

Affected Products

• hexpm hex_core: versions 0.1.0 to before 0.12.1
• hexpm hex: versions 2.3.0 to before 2.3.2
• erlang rebar3: versions 3.9.1 to before 3.27.0

Discovery Timeline

• 2026-02-27 - CVE CVE-2026-21619 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-21619

Vulnerability Analysis

This vulnerability stems from improper handling of data received from API responses in the Hex package management ecosystem. The affected components process external data through deserialization routines without adequate validation, creating two distinct attack surfaces: object injection through deserialization of untrusted data (CWE-400) and resource exhaustion through excessive memory allocation.

The vulnerability is accessible over the network but requires user interaction and specific preconditions to be exploited. An attacker would need to position themselves to intercept or manipulate API responses between the Hex client and the package registry, or compromise the registry itself.

The impact is primarily limited to availability concerns, where an attacker could cause excessive resource consumption on developer machines or CI/CD systems running vulnerable versions of these tools during package resolution or installation operations.

Root Cause

The root cause lies in the request/4 functions across three related codebases that share similar API handling logic. These functions process responses from the Hex package registry without sufficient validation of the incoming data structure before deserialization. The Erlang term format used in these communications allows for complex nested structures that, when maliciously crafted, can consume excessive memory or inject unexpected objects into the application state.

Attack Vector

The attack vector is network-based, requiring an attacker to either perform a man-in-the-middle attack against Hex API communications or compromise a package source. The exploitation scenario involves:

1. An attacker intercepts or controls API responses from a Hex package registry
2. Maliciously crafted response data is sent containing either deeply nested structures (for resource exhaustion) or specially crafted terms (for object injection)
3. The vulnerable request/4 function deserializes this data without proper bounds checking
4. The victim's system experiences memory exhaustion or processes injected objects

The vulnerability affects build tools used in development and CI/CD pipelines, making it particularly relevant for supply chain security considerations, though the direct impact is limited to availability.

Detection Methods for CVE-2026-21619

Indicators of Compromise

• Unusual memory consumption spikes during Hex package operations or mix deps.get commands
• Unexpected crashes or out-of-memory errors in rebar3 or Mix build processes
• Abnormal network traffic patterns to Hex API endpoints with unusually large response payloads
• Build pipeline failures accompanied by resource exhaustion errors

Detection Strategies

• Monitor system resource utilization (memory, CPU) during package manager operations for anomalous spikes
• Implement network traffic analysis to detect unusually large or malformed responses from Hex registry endpoints
• Configure build system timeouts and resource limits to catch runaway processes indicative of exploitation
• Review application logs for deserialization errors or unexpected object types in Hex-related modules

Monitoring Recommendations

• Enable verbose logging for Hex operations in development and CI/CD environments to capture potential attack indicators
• Implement memory and CPU resource limits on build containers to contain potential resource exhaustion attacks
• Monitor network connections from build systems to package registries for suspicious TLS certificate changes or unexpected endpoints
• Set up alerts for build failures that correlate with high memory usage patterns

How to Mitigate CVE-2026-21619

Immediate Actions Required

• Upgrade hex_core to version 0.12.1 or later immediately
• Upgrade hex (Elixir) to version 2.3.2 or later
• Upgrade rebar3 to version 3.27.0 or later
• Audit CI/CD pipelines and development environments to identify all instances of vulnerable tool versions

Patch Information

Security patches have been released for all affected components. The fixes address the unsafe deserialization by implementing proper validation of incoming data before processing:

• hex_core: Fixed in commit cdf726095bca85ad2549d146df1e831ae93c2b13
• hex: Fixed in commit 636739f3322514e9303ca335fb630696fcbb3c95
• rebar3: Fixed in commit 1d4478f527e373de0b225951e53115450e0d9b9d

For additional details, refer to the GitHub Security Advisory GHSA-hx9w-f2w9-9g96.

Workarounds

• Implement network-level controls to ensure Hex API communications are only permitted to trusted registry endpoints
• Configure resource limits (memory, CPU) on build systems to contain potential resource exhaustion
• Use locked dependency files (mix.lock) and avoid dynamic dependency resolution in production CI/CD pipelines until patched
• Consider temporarily pinning to known-safe package versions and disabling automatic dependency updates

# Update hex_core, hex, and rebar3 to patched versions
# For Elixir/Mix projects:
mix local.hex --force

# For rebar3 projects, update to 3.27.0 or later:
# Download latest rebar3 from https://github.com/erlang/rebar3/releases
# Or use your package manager to update

# Verify installed versions
mix hex.info
rebar3 version