CVE-2026-103502

Name of the Vulnerable Software and Affected Versions hex core versions 0.1.0 through 0.19.9

Description Improper certificate validation in hex core allows an attacker capable of intercepting HTTPS connections to impersonate hex.pm, repo.hex.pm, or other repository and API servers. This occurs when programs use the default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating system's CA certificates cannot be loaded.

The issue stems from the hex core:default config/0 function selecting the hex http httpc adapter. When hex http httpc:http options/2 attempts to verify the server certificate using public key:cacerts get/0, a failure in that call (which happens by default on OTP 24 or when no CA store is found on OTP 25) causes the adapter to send the request without ssl options. Consequently, the ssl application uses defaults that do not verify the server certificate on versions prior to OTP 26. Versions of hex core before 0.11.0 are affected on all OTP versions prior to 26 regardless of CA store availability because they never set ssl options.

An attacker on the network path can complete the TLS handshake with any certificate, allowing them to intercept API keys, OAuth tokens, and repository keys, as well as alter API requests and responses.

Recommendations Upgrade hex core to version 0.20.0 or later. As a temporary workaround, pass ssl options that verify the server certificate in the adapter config, such as {hex http httpc, #{http options => [{ssl, SslOpts}]}}. As a temporary workaround, use an alternative HTTP adapter instead of the default hex http httpc adapter. As a temporary workaround, run the application on OTP 26 or later.