CVE-2026-21619: Unsafe Deserialization in hex_core Leading to Resource Exhaustion
Summary
CVE-2026-21619: Unsafe Deserialization of Erlang Terms in hex_core. Affects hex_core across 4 version ranges.
>= 0.1.0, < 0.12.1
>= 209c02ec57c2cc3207ee0174c3af3675b8dc8f79, < 1d4478f527e373de0b225951e53115450e0d9b9d
>= 314546ac432229518714cc8e3336e916b9da6305, < 636739f3322514e9303ca335fb630696fcbb3c95
>= eb327f8edfe45507351e38cc0805aa12fa647f0b, < cdf726095bca85ad2549d146df1e831ae93c2b13
Fixed in 0.12.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
hex_core is a package within the Hex ecosystem that facilitates package management for Erlang applications. It provides essential functionalities for managing dependencies and ensuring the integrity of package installations. However, it has been found to be vulnerable to unsafe deserialization, which can lead to significant security risks if exploited.
Vulnerability Detail
The vulnerability identified as CVE-2026-21619 arises from uncontrolled resource consumption and deserialization of untrusted data within the hex_core, hex, and rebar3 packages. Specifically, the issue allows for object injection and excessive resource allocation, potentially leading to denial of service or other malicious outcomes. The affected code resides in the hex_api and mix_hex_api modules, with critical routines being hex_core:request/4, mix_hex_api:request/4, and r3_hex_api:request/4. This vulnerability affects versions of hex_core prior to 0.12.1, hex prior to 2.3.2, and rebar3 prior to 3.27.0.
How To Fix
Latest published version: 0.21.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement input validation to sanitize the data being deserialized. This can help mitigate the risk of object injection until the packages are updated. For example, ensure that any incoming data is strictly validated against expected formats before processing.
Conclusion
CVE-2026-21619 presents a significant risk to applications using the hex_core, hex, and rebar3 packages due to unsafe deserialization vulnerabilities. It is crucial to update to the patched versions to mitigate potential security threats and ensure the stability of your applications.
See every vulnerability recorded for hex_core →
FAQ
CVE-2026-21619 is a vulnerability in the hex_core, hex, and rebar3 packages that allows for unsafe deserialization of untrusted data, leading to potential resource exhaustion.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
Exploitation of this vulnerability can lead to denial of service, excessive resource consumption, and potential object injection attacks, compromising the integrity and availability of your application.
The vulnerability affects hex_core versions prior to 0.12.1, hex versions prior to 2.3.2, and rebar3 versions prior to 3.27.0.
You can update the packages using the mix command for hex_core and hex, and by cloning the rebar3 repository for rebar3. Ensure to follow the specific commands provided in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for hex_core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
