ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-96618

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine ru

Published Oct 12, 2026 · catalog updated Oct 16, 2026 · Improper Handling of Highly

Check if you run it

No confirmed exploitation is on record for CVE-2026-96618. EPSS is 0.33%. Act only if a listed version of Improper Handling of Highly is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Improper Handling of Highly).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Low—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.33%
Remediation
Advisory link
Affected products
Debian:13 erlang-hex · Debian:14 erlang-hex

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with HEX_MIRROR_URL, HEX_MIRROR or mirror_url as untrusted: it doesn't send credentials to it, and it checks registry signatures and package checksums that the mirror can't forge. Several response paths consume memory or disk in proportion to what the mirror sends before any of those checks run. Hex.HTTP.request/5 reads the whole response body into memory and decompresses it with :zlib.gunzip/1 whenever the response's Content-Encoding contains gzip, with no limit on the compressed or decompressed size. Hex doesn't ask for compressed responses, so the server decides whether this step runs. It applies to registry, package, docs and API responses. Package tarballs have no download size limit. Hex 2.5.1 holds the whole tarball in memory and writes it to the cache, and the development branch streams it to a temporary file; the 16 MiB tarball limit is checked only when the file is unpacked. The tarball is then unpacked, into deps/ in 2.5.1 and into a staging directory on the development branch, before its checksums are compared with the registry. mix hex.docs fetch, and mix hex.docs offline when docs are missing, write the docs tarball to disk and extract it with :mix_hex_erl_tar.extract/2 without the 16 MiB compressed and 128 MiB decompressed limits that mix_hex_tarball:unpack_docs/3 applies. The signed registry doesn't cover docs tarballs, so nothing checks them. Registry responses are also decompressed before their signature is checked, in hex_core code that Hex vendors; that part is tracked in https://github.com/hexpm/hex_core/security/advisories/GHSA-7c4r-cgf9-9jmq. This issue affects hex: from 0.11.2 before 2.5.2.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Debian:13 erlang-hex2.0.6-2, 2.4.2-1, 2.4.2-2
  • Debian:14 erlang-hex2.0.6-2, 2.4.2-1, 2.4.2-2

How to fix CVE-2026-96618

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-96618. EPSS is 0.33%. Act only if a listed version of Improper Handling of Highly is installed.

Which versions are affected?

Compare what you have installed with 2.0.6-2, 2.4.2-1, 2.4.2-2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.33%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Debian security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · Tenable CVE Database

    Detected

    Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with HEX_MIRROR_URL, HEX_MIRROR or mirror_url as untrusted: it doesn't send credentials to it, and it check

  2. Oct 16, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with HEX_MIRROR_URL, HEX_MIRROR or mirror_url as untrusted: it doesn't send credentials to it, and it check

Sources

  • CVE.orgVulnerability recordCVE-2026-96618

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-96618

    30-day exploitation probability 0.3%

    first.org
  • OpenSSF OSV / OSV ScannerPackage advisoryDEBIAN-CVE-2026-96618
    osv.dev
  • Tenable CVE DatabaseVulnerability recordCVE-2026-96618

    Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with HEX_MIRROR_URL, HEX_MIRROR or mirror_url as untrusted: it doesn't send credentials to it, and it check

    tenable.com
  • Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-96618

    Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirro

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.