Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-27 | 1 | Disclosure1 |
| 2026-03-07 | 1 | Patch1 |
The CVE-2026-21619 advisory for hex_core is a must-patch for anyone on #CentOS 8/#Fedora running Erlang/Elixir tooling. Read more: 👉 https://tinyurl.com/ypdfc3p5 #Security https://t.co/HGmpIjJHuc
Post summary
The advisory emphasizes that hex_core on CentOS 8/Fedora, especially for Erlang/Elixir users, requires immediate patching.
CVE-2026-21619 Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3… https://www.cve.org/CVERecord?id=CVE-2026-21619
Post summary
A brief mention of CVE-2026-21619 highlighting uncontrolled resource consumption and deserialization flaws in hexpm modules, with a link to the CVE record.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | erlang | rebar3 | - | - | - |
| App | hex | hex | - | - | - |
| App | hex | hex_core | - | - | - |