gleam-lang CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH gleam-lang CVE published 2026-07-29

CVE-2026-59247

A vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. This issue affects Gleam versions from 0.18.0 before 1.18.0 and can result in loss of integrity of the downloaded package contents. The vulnerability is caused by insufficient verification of data authenticity in Gleam, which allows an adversary in the middle to substitute for [truncated]