CVE-2026-23940

Medium

Description

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality. This issue affects hex.pm: before 2026-03-10.

SeverityMedium

CVSS6.5

Exploit probability—

ProductHexpm

PublishedMar 13, 2026

First seenMar 13, 2026

Weakness typeCWE-400Uncontrolled resource consumption

How to fix

Update

hex hexpm2026-03-09 or later

Patches

github.com/hexpm/hexpm/commit/495f01607d3eae4aed7ad09b2f54f31ec7a7df01

Vendor advisories

github.com/hexpm/hexpm/security/advisories/GHSA-jp8w-gxf6-8hcr

Affected products

Product	Affected versions	Fixed in
hex hexpm	v < 2026-03-09	2026-03-09

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.