CVE-2026-103502 hexpm CVE debrief

Who should care

Erlang/OTP 24 and 25 users who utilize hex_core for HTTPS connections should assess their exposure and verify certificate validation. This includes developers and administrators responsible for maintaining systems that use hex_core for secure communication.

Why it matters

CVE-2026-103502 is a medium-severity vulnerability in hex_core that affects Erlang/OTP 24 and 25. It allows for man-in-the-middle attacks due to improper certificate validation. Users of affected versions should verify their exposure and update to a secure version of hex_core.

• Man-in-the-middle attacks possible due to lack of certificate verification
• Impersonation of hex.pm, repo.hex.pm, or other repositories/API servers
• Potential for eavesdropping and tampering with secure communications
• Requires verification of certificate validation and potential updates to hex_core

Technical summary

The hex_core library's default HTTP adapter, hex_http_httpc, fails to verify TLS certificates on Erlang/OTP 24 and 25. This vulnerability allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm, or other repositories/API servers. The issue arises because hex_core's default adapter does not properly configure SSL options for certificate verification. Users of affected versions should verify their exposure and update to a secure version of hex_core. The vulnerability is a result of the adapter's fallback behavior when it cannot load the system's CA certificates, leading to a lack of certificate verification.

Defensive priority

Erlang/OTP 24 and 25 users should assess exposure and verify certificate validation

Recommended defensive actions

• Verify certificate validation in hex_core on Erlang/OTP 24 and 25
• Assess exposure and update to hex_core version 0.20.0 or later
• Implement proper certificate validation for HTTPS connections
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the Improper Certificate Validation vulnerability in hex_core. The vulnerability allows an attacker to impersonate hex.pm, repo.hex.pm, or other repositories/API servers to programs using hex_core's default HTTP adapter on Erlang/OTP 24 or OTP 25 when the system's CA certificates can't be loaded.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.