CVE-2026-23940
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In hexpm/hexpm before commit 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 and hex.pm before 2026-03-10, an uncontrolled resource consumption vulnerability exists. Publishing an oversized package can cause memory exhaustion during tarball extraction, leading to denial of service.
Risk Assessment
An attacker could crash the Hex.pm instance, preventing package publishing and potentially other package-processing functionality.
Recommendation
Update hexpm to a version containing commit 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 or later, and limit the size of uploaded packages.
Original NVD description (English source)
Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality. This issue affects hexpm: before 495f01607d3eae4aed7ad09b2f54f31ec7a7df01; hex.pm: before 2026-03-10.