CVE-2026-59247 gleam-lang CVE debrief

Who should care

Developers using Gleam and Hex packages, DevOps teams managing dependencies, and security teams monitoring for vulnerabilities in the software supply chain should verify the integrity of downloaded packages, use secure connections to the Hex repository, and update Gleam to version 1.18.0 or later. These teams should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection,

Why it matters

This vulnerability allows an adversary in the middle to substitute forged Hex package contents during dependency resolution in Gleam, leading to loss of integrity of the downloaded package contents. Developers and DevOps teams should verify the integrity of downloaded packages, use secure connections to the Hex repository, and update Gleam to version 1.18.0 or later.

• Loss of integrity of downloaded package contents
• Potential for unauthorized modifications to dependencies
• Need for verification of package checksums
• Requirement for secure connections to the Hex repository

Technical summary

The vulnerability exists in Gleam versions from 0.18.0 before 1.18.0. An adversary in the middle can intercept TLS with a certificate trusted by the Gleam process and modify both the API release response and the corresponding repository tarball to supply a package archive with a matching forged checksum. This allows the adversary to substitute forged Hex package contents during dependency resolution in Gleam, leading to loss of integrity of the downloaded package contents. The vulnerability is due to insufficient verification of data authenticity in Gleam, which

Defensive priority

High

Recommended defensive actions

• Verify the integrity of downloaded packages by checking the checksum
• Use a secure connection to the Hex repository
• Update Gleam to version 1.18.0 or later
• Monitor for suspicious activity in the dependency resolution process
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability exists in Gleam versions from 0.18.0 before 1.18.0. An adversary in the middle can intercept TLS with a certificate trusted by the Gleam process and modify both the API release response and the corresponding repository tarball to supply a package archive with a matching forged checksum.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.