Hexpm Hex Core vulnerabilities

3 CVEs affecting Hexpm Hex Core, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96596, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-105274, published 2026-10-12. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the…
CVE-2026-103502, published 2026-10-12. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to…
CVE-2026-96596, published 2026-10-14. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3…