Is CVE-2026-103502 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103502 being exploited in the wild.

How severe is CVE-2026-103502?

Informational severity, published 12 October 2026.

Which products and versions are affected?

Hexpm Hex Core 0.1.0 to 0.20.0 (before fix).

How is CVE-2026-103502 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-103502?

Check whether you run Hexpm Hex Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103502: hexpm hex_core improper certificate validation in HTTPS

CVE-2026-103502 · Severity: info · Published 2026-10-12

hex_core is a package manager client library for Erlang/OTP that downloads dependencies over HTTPS. Due to improper certificate validation in the default HTTP adapter, an attacker able to intercept network traffic could impersonate the package repository and deliver malicious code. This affects users on Erlang/OTP 24 (always) and OTP 25 (when system CA certificates are unavailable).

Technologies: Hexpm Hex Core. Vendors: Hexpm.

Quick answers

Is CVE-2026-103502 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103502 being exploited in the wild.
How severe is CVE-2026-103502?: Informational severity, published 12 October 2026.
Which products and versions are affected?: Hexpm Hex Core 0.1.0 to 0.20.0 (before fix).
Is there a fix for CVE-2026-103502?: Yes: fixed in hex_core 0.20.0. Until then: Use an alternative HTTP client library instead of the default hex_http_httpc adapter, or upgrade to Erlang/OTP 26 where the ssl application verifies certificates by default. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103502 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-103502?: Check whether you run Hexpm Hex Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: hex_core 0.20.0

Use an alternative HTTP client library instead of the default hex_http_httpc adapter, or upgrade to Erlang/OTP 26 where the ssl application verifies certificates by default.

Technical details

The default hex_http_httpc adapter fails to verify HTTPS server certificates on OTP 24 and 25: on OTP 24, public_key:cacerts_get/0 does not exist, and on OTP 25 it raises when no CA store is found. When certificate loading fails, the adapter prints a warning but continues without SSL verification, relying on the ssl application's defaults which do not verify certificates before OTP 26. This allows network-level MITM attacks against package downloads.

Affected products

hexpm hex_core 0.1.0 to 0.20.0 (before fix)

Timeline

2026-10-12: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.