# CVE-2026-103503: hexpm hex improper certificate validation in SSL opts

Source: https://junglewise.ai/threats/cve-2026-103503-improper-certificate-validation-vulnerability-in-hexpm-hex  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-103503 · Severity: info · Published 2026-10-12

Hex is a package manager for Elixir that downloads dependencies over HTTPS. A flaw in certificate validation allows an attacker on the network to impersonate Hex repositories and intercept API keys and OAuth tokens if the user has configured a custom CA certificate store. The vulnerability bypasses the user's intended certificate restrictions by trusting Hex's bundled CA list regardless of the custom configuration.

Technologies: [Hexpm Hex](https://junglewise.ai/threats/technologies/hexpm-hex). Vendors: [Hexpm](https://junglewise.ai/threats/vendors/hexpm).

## Quick answers

**Is CVE-2026-103503 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103503 being exploited in the wild.

**How severe is CVE-2026-103503?** Informational severity, published 12 October 2026.

**Which products and versions are affected?** Hexpm Hex from 0.20.2 before 2.5.2.

**Is there a fix for CVE-2026-103503?** Yes: fixed in 2.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103503 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103503?** Check whether you run Hexpm Hex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.5.2

## Technical details

The vulnerability exists in Hex.HTTP.SSL where the partial_chain callback is built from the bundled CA store even when cacerts_path is configured to use a different CA store. This allows a certificate chain to be validated if any certificate in it matches a public key in the bundled store, bypassing the user's custom CA restrictions. An attacker holding a certificate for a Hex host issued by any CA in Hex's bundled store can impersonate that host to users who set cacerts_path to exclude that CA. Hostname verification still applies, so the attacker must hold a valid certificate for the target host.

## Affected products

- hexpm hex from 0.20.2 before 2.5.2

## Timeline

- 2026-10-12: disclosed

## References

- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-103503.html](https://cna.erlef.org/cves/CVE-2026-103503.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [hexpm hex_core memory exhaustion via compressed data amplification](https://junglewise.ai/threats/cve-2026-105274-improper-handling-of-highly-compressed-data-data-amplification)
- [Hex package manager data amplification via compressed responses](https://junglewise.ai/threats/cve-2026-96618-improper-handling-of-highly-compressed-data-data-amplification)
- [Hex path traversal in unvalidated dependency app names](https://junglewise.ai/threats/cve-2026-96612-improper-limitation-of-a-pathname-to-a-restricted-directory-path)
- [Hex terminal escape sequence injection via package metadata](https://junglewise.ai/threats/cve-2026-81856-improper-neutralization-of-escape-meta-or-control-sequences)