7.1
Élevée
CVE-2026-23940 Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation
Description
Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality. This issue affects hex.pm: before 2026-03-10.
Produits et versions touchés
Références
- github.com github.com
- EEF CNA record for CVE-2026-23940 cna.erlef.org
- OSV record EEF-CVE-2026-23940 osv.dev
- Introducing commit 82911da in hexpm/hexpm github.com
- Fix commit 495f016 in hexpm/hexpm github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de hexpm
Les 8 CVE de hexpm →
CVE-2026-86698
Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization…
2.3
Faible
CVE-2026-75554
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from…
2.3
Faible
CVE-2026-75542
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the…
8.3
Élevée
CVE-2026-21622
Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows…
9.5
Critique