Approved changes feed: RSS · Atom
cpe:2.3:a:hex:hex_core:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Hex (6e363ea8-9c72-5274-8537-0a6ba8dd6843) |
|---|---|
| Product | Hex Core (f9441ed6-f0a3-5742-86e7-d32146595cd0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/hexpm/hex_core |
purl2cpe | 2026-06-01 10:11:59.863491 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-21619 |
vulnerable | 2026-06-08 07:49:16.615358 |
Unsafe Deserialization of Erlang Terms in hex_core
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4.
This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
Published: 2026-02-27T17:57:11.513Z
Updated: 2026-05-27T15:40:33.166Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-1000013 |
vulnerable | 2026-06-08 05:12:21.347808 |
Details available
Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0.
Published: 2019-02-04T21:00:00.000Z
Updated: 2024-08-05T03:00:19.415Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.