# CVE-2026-105274: hexpm hex_core memory exhaustion via compressed data amplification

Source: https://junglewise.ai/threats/cve-2026-105274-improper-handling-of-highly-compressed-data-data-amplification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-105274 · Severity: info · Published 2026-10-12

hex_core is a package management library for Erlang that downloads and verifies software packages. An untrusted package repository mirror or compromised server can send specially crafted compressed data that exhausts all available memory when decompressed, causing the Erlang VM to crash and disrupting package management operations. The same vulnerability affects the vendored copies in Hex and rebar3 build tools.

Technologies: [Hexpm Hex](https://junglewise.ai/threats/technologies/hexpm-hex), [Hexpm Hex Core](https://junglewise.ai/threats/technologies/hex-core). Vendors: [Hexpm](https://junglewise.ai/threats/vendors/hexpm).

## Quick answers

**Is CVE-2026-105274 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105274 being exploited in the wild.

**How severe is CVE-2026-105274?** Informational severity, published 12 October 2026.

**Which products and versions are affected?** Erlang-Solutions Rebar3 3.9.1 to before 3.27.3; Hexpm Hex 2.1.0 to before 2.5.2; Hexpm Hex Core 0.1.0 to before 0.20.0.

**Is there a fix for CVE-2026-105274?** Yes: fixed in hex_core 0.20.0; Hex 2.5.2; rebar3 3.27.3. Until then: Restrict package repository access to trusted mirrors and configure repository verification to use pinned public keys where possible to prevent man-in-the-middle attacks from untrusted servers.</anigation>
</invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105274 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-105274?** Check whether you run Erlang-Solutions Rebar3, Hexpm Hex or Hexpm Hex Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in hex_core 0.20.0; Hex 2.5.2; rebar3 3.27.3

Restrict package repository access to trusted mirrors and configure repository verification to use pinned public keys where possible to prevent man-in-the-middle attacks from untrusted servers.</anigation>
</invoke>

## Technical details

The vulnerability is a data amplification flaw in decompression handling: hex_repo functions decompress zlib responses and decode signed envelopes before verifying signatures, allowing a mirror to provide small compressed payloads that expand to arbitrary sizes in memory. Additionally, hex_api's safe_binary_to_term/1 accepts compressed Erlang terms and builds the full decoded term before validating its structure, providing no size limits on decompressed output.

## Affected products

- hexpm hex_core 0.1.0 to before 0.20.0
- hexpm Hex 2.1.0 to before 2.5.2
- erlang-solutions rebar3 3.9.1 to before 3.27.3

## Timeline

- 2026-10-12: disclosed

## References

- [https://github.com/](https://github.com/)
- [https://repo.hex.pm/](https://repo.hex.pm/)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [Hex package manager data amplification via compressed responses](https://junglewise.ai/threats/cve-2026-96618-improper-handling-of-highly-compressed-data-data-amplification)
- [Hex path traversal in unvalidated dependency app names](https://junglewise.ai/threats/cve-2026-96612-improper-limitation-of-a-pathname-to-a-restricted-directory-path)
- [Hex terminal escape sequence injection via package metadata](https://junglewise.ai/threats/cve-2026-81856-improper-neutralization-of-escape-meta-or-control-sequences)
- [Hex release-age cooldown bypass via package retirement](https://junglewise.ai/threats/cve-2026-105668-protection-mechanism-failure-vulnerability-in-hexpm-hex-allows)