Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
Severity and exploitation
KEV coverage does not rule out exploitation.
Assessment vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSeverity
low2.1CVSS measures technical severity, not the likelihood of an attack.
Known exploitation
Not listed in the checked CISA KEV catalog
Absence from CISA KEV does not rule out attacks.
Public exploit
Not established by this record
Missing evidence does not mean no public exploit exists.
Remediation
Source guidance available
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
What this means
Hex versions 0.11.2 before 2.5.2 are vulnerable to memory and disk exhaustion from an untrusted mirror, due to improper handling of highly compressed data and unlimited resource allocation. An attacker with access to the mirror can cause this exhaustion. The impact is memory or disk space exhaustion on the machine running Hex.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Attack conditions
No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.
Review supporting sources →Affected versions
Check the exact model, release, and any platform requirements against your installation.
hexpm · EEF
hex
1 range
hexpm · EEF
hex
Package identity
pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.gitIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0.11.2 → before 2.5.2
semver versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*hexpm · EEF
hex
1 range
hexpm · EEF
hex
Package identity
pkg:github/hexpm/hexIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
51ea632424fb6ea8765148f96dc25dfeb526b1f8 → before *
git versions
From bb5189eade682c5fc3f98d9725973a7beb4e1deb: unaffected
From 08956100a8283ba500a123e5539ac64d5d7e91d8: unaffected
Source order retained; this version scheme requires manual review.
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*What to do
Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.
Upgrade Hex to 2.5.2 or later, for example with mix local.hex. Hex then stops downloading a registry file, package, docs tarball or other file from a repository or mirror once it's larger than 16 MiB, including after decompressing a gzip-encoded response, and checks packages against the registry checksum before writing them to the package cache or unpacking a cached copy.
Fetch from repo.hex.pm or a mirror you operate. Running Mix under operating system memory and disk limits, such as container limits, confines the effect to that container.
cve.new guidance unless attributed to a publisher. This page does not inspect your installation.
Public exploit evidence
No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.
Original source description
Read the full publisher description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch.
Hex treats a mirror configured with HEX_MIRROR_URL, HEX_MIRROR or mirror_url as untrusted: it doesn't send credentials to it, and it checks registry signatures and package checksums that the mirror can't forge. Several response paths consume memory or disk in proportion to what the mirror sends before any of those checks run.
Hex.HTTP.request/5 reads the whole response body into memory and decompresses it with :zlib.gunzip/1 whenever the response's Content-Encoding contains gzip, with no limit on the compressed or decompressed size. Hex doesn't ask for compressed responses, so the server decides whether this step runs. It applies to registry, package, docs and API responses.
Package tarballs have no download size limit. Hex 2.5.1 holds the whole tarball in memory and writes it to the cache, and the development branch streams it to a temporary file; the 16 MiB tarball limit is checked only when the file is unpacked. The tarball is then unpacked, into deps/<app> in 2.5.1 and into a staging directory on the development branch, before its checksums are compared with the registry.
mix hex.docs fetch, and mix hex.docs offline when docs are missing, write the docs tarball to disk and extract it with :mix_hex_erl_tar.extract/2 without the 16 MiB compressed and 128 MiB decompressed limits that mix_hex_tarball:unpack_docs/3 applies. The signed registry doesn't cover docs tarballs, so nothing checks them.
Registry responses are also decompressed before their signature is checked, in hex_core code that Hex vendors; that part is tracked in https://github.com/hexpm/hex_core/security/advisories/GHSA-7c4r-cgf9-9jmq.
This issue affects hex: from 0.11.2 before 2.5.2.
References
6 sourcesInside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-96618View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
EEF · platform conditions
All conditions must hold
Any condition may hold
Vulnerable product
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*From (inclusive): 0.11.2
Before: 2.5.2
Applicability preview
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.5.2",
"versionStartIncluding": "0.11.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
Timeline
All times UTCAdvisory published
Publication date supplied by the source.
Source updated
Latest modification date supplied by the source.
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.