PT-2026-110652 · Hexpm · Hex
CVSS v4.0
2.1
Low
| Vector | AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
hexpm hex versions 0.11.2 through 2.5.1
Description
An improper handling of highly compressed data, known as data amplification, allows an untrusted package mirror to exhaust the memory or disk space of a machine running
mix deps.get, mix deps.update, mix hex.package fetch, or mix hex.docs fetch. This occurs when a mirror is configured via HEX MIRROR URL, HEX MIRROR, or mirror url.Technical details include:
- The function
Hex.HTTP.request/5reads the entire response body into memory and decompresses it using:zlib.gunzip/1if theContent-Encodingcontainsgzip, without limits on compressed or decompressed size. This affects registry, package, docs, and API responses. - Package tarballs lack download size limits. In version 2.5.1, the entire tarball is held in memory and written to cache before the 16 MiB limit is checked during unpacking.
- The commands
mix hex.docs fetchandmix hex.docs offlinewrite docs tarballs to disk and extract them using:mix hex erl tar.extract/2without applying the 16 MiB compressed and 128 MiB decompressed limits used bymix hex tarball:unpack docs/3. - Registry responses are decompressed before their signatures are verified.
Recommendations
Upgrade hexpm hex to version 2.5.2 or later using
mix local.hex.
As a temporary workaround, fetch packages only from repo.hex.pm or a mirror you operate.
Run Mix under operating system memory and disk limits, such as container limits, to confine the impact.Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Hex