2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-21619

CVE-2026-21619: hex_core has Unsafe Deserialization of Erlang Terms

Impact

The Hex client (hex_core) deserializes Erlang terms received from the Hex API using binary_to_term/1 without sufficient restrictions.

If an attacker can control the HTTP response body returned by the Hex API, this allows denial-of-service attacks such as atom table exhaustion, leading to a VM crash. No released versions are known to allow remote code execution.

Patches

https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13
https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95
https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d

Workarounds

Ensure that the Hex API URL (HEX_API_URL) points only to trusted endpoints. There is no client-side workaround that fully mitigates this issue without applying the patch.

Resources

hex_core Module: https://github.com/hexpm/hex_core/blob/main/src/hex_api.erl
Hex Vendored Module: https://github.com/hexpm/hex/blob/main/src/mix_hex_api.erl
Rebar3 Vendored Module: https://github.com/erlang/rebar3/blob/main/apps/rebar/src/vendored/r3_hex_api.erl
hex_core Patch: https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13
Hex Vendored Patch: https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95
Rebar3 Vendored Patch: https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-21619

CVE-2026-21619:

2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hex_core	erlang	< 0.12.1	0.12.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the unsafe deserialization of Erlang terms from HTTP API responses. The function request/4, present in hex_core and its vendored versions in hex and rebar3, directly uses binary_to_term/1 on the response body. This function is known to be unsafe on untrusted input as it allows the creation of new atoms. An attacker, by controlling the API response, could send a crafted binary term that creates a vast number of unique atoms, leading to the exhaustion of the Erlang VM's atom table. This causes the VM to crash, resulting in a denial-of-service. The patches for all three affected repositories replace the direct call to binary_to_term/1 with a new, safer function (safe_binary_to_term/1) that internally calls binary_to_term/2 with the safe option. This option prevents the creation of new atoms, thus mitigating the DoS vulnerability. The safe function also validates the term to prevent the deserialization of executable code, hardening it against potential remote code execution.

Vulnerable functions

hex_api:request/4

src/hex_api.erl

The function `request/4` in `hex_api.erl` uses `binary_to_term/1` to deserialize the HTTP response body. An attacker controlling the response could provide a malicious payload that exhausts the atom table, causing a denial of service. The patch replaces the unsafe call with `hex_safe_binary_to_term:safe_binary_to_term/1`, which uses the `safe` option to prevent this.

mix_hex_api:request/4

src/mix_hex_api.erl

This is a vendored version of `hex_api:request/4` in the `hex` project. It has the same vulnerability where `binary_to_term/1` is used unsafely on the response body. The patch applies the same fix by switching to a safe deserialization function.

r3_hex_api:request/4

apps/rebar/src/vendored/r3_hex_api.erl

This is a vendored version of `hex_api:request/4` in the `rebar3` project. It has the same vulnerability where `binary_to_term/1` is used unsafely on the response body. The patch applies the same fix by switching to a safe deserialization function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.