7.1
High
CVE-2026-23940 Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation
Description
Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality. This issue affects hex.pm: before 2026-03-10.
Affected products and versions
References
- github.com github.com
- EEF CNA record for CVE-2026-23940 cna.erlef.org
- OSV record EEF-CVE-2026-23940 osv.dev
- Introducing commit 82911da in hexpm/hexpm github.com
- Fix commit 495f016 in hexpm/hexpm github.com
Timeline
- Published
- Last modified
Other CVEs of hexpm
The 8 CVEs of hexpm →
CVE-2026-86698
Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization…
2.3
Low
CVE-2026-75554
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from…
2.3
Low
CVE-2026-75542
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the…
8.3
High
CVE-2026-21622
Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows…
9.5
Critical