CVE-2026-23940

Katalog CVE

CVSS 6.5 · Medium EPSS 0,46%

Kerentanan Uncontrolled Resource Consumption pada hexpm. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality. This issue affects hex.pm: before 2026-03-10.

Rincian

Terbit di NVD

13 Maret 2026

Terakhir diubah

8 September 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/hexpm/hexpm/security/advisories/GHSA-jp8w-gxf6-8hcr mitigasi · advisory vendor
• https://github.com/hexpm/hexpm/commit/495f01607d3eae4aed7ad09b2f54f31ec7a7df01 patch
• https://cna.erlef.org/cves/CVE-2026-23940.html
• https://github.com/hexpm/hexpm/commit/82911daf5f8fb2ab44f298e3ba22b90bc1ae3746
• https://osv.dev/vulnerability/EEF-CVE-2026-23940