CVE-2026-23940 · published 2026-03-13 · updated 2026-09-08

Denial of Service via Oversized Package Upload

HIGH 7.1 CWE-400 · Uncontrolled Resource Consumption
OSV.dev JSON

Am I affected?

type your hexpm/hexpm version to check

Description

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation.

Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality.

This issue affects hex.pm: before 2026-03-10.

Weaknesses & attack patterns

Weakness

CWE-400 · Uncontrolled Resource Consumption in catalog → MITRE ↗

Attack patterns

CAPEC-130 · Excessive Allocation MITRE ↗

Affected — hexpm / hexpm

< 2026-03-10 affected
every other version: unaffected
cpe cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*

Affected — GitHub / hexpm/hexpm Repository ↗

≥ 82911da < 495f016 affected
every other version: unaffected
cpe cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*

Workarounds

  • Prevent large package uploads by enforcing upload size limits at the reverse proxy or load balancer level.

References

github.com/hexpm/hexpm · GHSA-jp8w-gxf6-8hcr ↗ vendor-advisory
Fix commit 495f016 in hexpm/hexpm (github.com) patch
OSV record EEF-CVE-2026-23940 (osv.dev) related
Introducing commit 82911da in hexpm/hexpm (github.com) related

Credits

Joud Zakharia / zentrust partners GmbH Finder
Eric Meadows-Jönsson / Hex.pm Remediation developer

CVSS breakdown

HIGH 7.1 open in calculator →
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
« All CVEs