Executive brief
Hex.pm, the package manager for the Erlang and Elixir ecosystem, is vulnerable to a denial-of-service attack. An attacker can upload a specially crafted, oversized package that causes the server to run out of memory during processing. This can crash the service, preventing developers from publishing new packages and disrupting other package-related operations.
Technical details
A vulnerability classified as CWE-400 (Uncontrolled Resource Consumption) exists in hexpm/hexpm. The root cause is the application's failure to limit memory allocation when extracting uploaded package tarballs. An authenticated attacker can trigger this by publishing an oversized package, causing the application instance to exhaust available RAM and terminate. The fix involves streaming request bodies to disk and using file-based tarball processing (via hex_core 0.13.0+) to reduce peak memory usage from ~160MB to less than 1MB per request. Patches were applied to the hex.pm service on 2026-03-10 and in the hexpm repository commit 495f016.
Affected products
- hexpm hexpm before 495f01607d3eae4aed7ad09b2f54f31ec7a7df01
- hexpm hex.pm before 2026-03-10
Timeline
- 2026-03-09: patched: Fix committed to hexpm repository
- 2026-03-10: patched: Hex.pm service updated
- 2026-03-13: disclosed: CVE-2026-23940 published