CVE-2026-105274

Name of the Vulnerable Software and Affected Versions rebar3 versions 3.9.1 through 3.27.2 hex versions 2.1.0 through 2.5.1 hex core versions 0.1.0 through 0.19.9

Description Improper handling of highly compressed data leads to a data amplification issue where an untrusted repository mirror or a server responding to API requests can exhaust the memory of the Erlang VM. In the hex repo module, the functions get names(), get versions(), get package(), and get policy() decompress registry responses using zlib:gunzip/1 and decode the signed envelope before the signature is verified. This allows a mirror to provide a small compressed response that expands into an envelope of arbitrary size. Additionally, hex api decodes responses with the application/vnd.hex+erlang content type via hex safe binary to term:safe binary to term/1, which utilizes binary to term(Binary, [safe]). While the safe option prevents atom creation, it does not limit the size of the decoded term, and the validation to reject functions and ports occurs only after the term has been constructed.

Recommendations Update rebar3 to version 3.27.3 or later. Update hex to version 2.5.2 or later. Update hex core to version 0.20.0 or later.