CVE-2026-96618 hexpm CVE debrief

Who should care

Defenders who use the hex package for Elixir should verify the versions in use and check for any oversized or compressed responses from untrusted mirrors. This vulnerability may impact systems that rely on the hex package for package management.

Why it matters

CVE-2026-96618 is a vulnerability in the hex package for Elixir that allows an untrusted package mirror to exhaust the memory or disk space of a machine running certain mix commands. Defenders should verify the versions of the hex package in use and check for any oversized or compressed responses from untrusted mirrors.

• Denial of service due to memory or disk exhaustion
• Potential for data loss or corruption due to untrusted mirror responses
• Need for verification of hex package versions and mirror configurations
• Possible impact on system availability and package management

Technical summary

The hex package for Elixir is vulnerable to a denial of service attack due to improper handling of highly compressed data. An untrusted package mirror can exhaust the memory or disk space of a machine running certain mix commands, such as mix deps.get, mix deps.update, mix hex.package fetch, or mix hex.docs fetch. This occurs because Hex.HTTP.request/5 reads the whole response body into memory and decompresses it with :zlib.gunzip/1 whenever the response's Content-Encoding contains gzip, with no limit on the compressed or decompressed size. Hex 2.5.1 holds the whole tarball in memory and writes it to the cache, and the development branch streams it to a temporary file; the 16 MiB tarball limit is checked only

Defensive priority

Defenders should prioritize verifying the versions of the hex package in use and checking for any oversized or compressed responses from untrusted mirrors.

Recommended defensive actions

• Verify the versions of the hex package in use and check for any oversized or compressed responses from untrusted mirrors.
• Implement limits on the size of responses from untrusted mirrors.
• Use a trusted package mirror or configure the hex package to use a trusted mirror.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the hex package's improper handling of highly compressed data. The package's HTTP client reads the whole response body into memory and decompresses it with zlib.gunzip/1 without any limit on the compressed or decompressed size. This can cause a denial of service when an untrusted mirror sends an oversized or compressed response.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.