CVE-2026-103503

Name of the Vulnerable Software and Affected Versions hexpm hex versions 0.20.2 through 2.5.1

Description Improper certificate validation allows an attacker capable of intercepting HTTPS connections to impersonate a Hex host. This occurs when users configure cacerts path (or HEX CACERTS PATH) to a specific CA store that excludes certain CAs, yet the software continues to trust the bundled CA store. Specifically, the Hex.HTTP.SSL.ssl opts/1 function builds a partial chain callback using the bundled store regardless of the cacerts path setting. Consequently, the Hex.HTTP.SSL.partial chain/2 function may accept a server chain if any certificate matches a public key in the bundled store, bypassing the user's restricted CA store. An attacker possessing a certificate for the host issued by a bundled CA can intercept API keys, OAuth tokens, and repository keys, and modify API responses. Hostname verification and package checksums remain active.

Recommendations Upgrade hexpm hex to version 2.5.2 or later.