Is CVE-2026-23940 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23940 being exploited in the wild.

How severe is CVE-2026-23940?

Medium severity, with a CVSS score of 6.5, published 13 March 2026.

Is there a fix for CVE-2026-23940?

A patch was published on 2026-03-09: Fix committed to hexpm repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23940 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-23940?

Check whether you run hexpm (Hex) or Hex.pm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23940: hexpm Denial of Service via Excessive Allocation in package extraction

CVE-2026-23940 · Severity: medium · CVSS 6.5 · Published 2026-03-13

Hex.pm, the package manager for the Erlang and Elixir ecosystem, is vulnerable to a denial-of-service attack. An attacker can upload a specially crafted, oversized package that causes the server to run out of memory during processing. This can crash the service, preventing developers from publishing new packages and disrupting other package-related operations.

Vendors: Hex.

Quick answers

Is CVE-2026-23940 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23940 being exploited in the wild.
How severe is CVE-2026-23940?: Medium severity, with a CVSS score of 6.5, published 13 March 2026.
Which products and versions are affected?: Hex.pm before 2026-03-10.
Is there a fix for CVE-2026-23940?: A patch was published on 2026-03-09: Fix committed to hexpm repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23940 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-23940?: Check whether you run hexpm (Hex) or Hex.pm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as CWE-400 (Uncontrolled Resource Consumption) exists in hexpm/hexpm. The root cause is the application's failure to limit memory allocation when extracting uploaded package tarballs. An authenticated attacker can trigger this by publishing an oversized package, causing the application instance to exhaust available RAM and terminate. The fix involves streaming request bodies to disk and using file-based tarball processing (via hex_core 0.13.0+) to reduce peak memory usage from ~160MB to less than 1MB per request. Patches were applied to the hex.pm service on 2026-03-10 and in the hexpm repository commit 495f016.

Affected products

hexpm hexpm before 495f01607d3eae4aed7ad09b2f54f31ec7a7df01
hexpm hex.pm before 2026-03-10

Timeline

2026-03-09: patched: Fix committed to hexpm repository
2026-03-10: patched: Hex.pm service updated
2026-03-13: disclosed: CVE-2026-23940 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.