CVE-2026-21619: Unsafe Deserialization in Erlang Hex Ecosystem (hex_core, rebar3)

Source: Dev.to

Overview

Vulnerability ID: CVE-2026-21619
CVSS Score: 2.0 (Low) – CVSS v4.0
Published: 2026-03-01

A critical unsafe deserialization vulnerability exists in hex_core, the reference implementation for the Hex package manager API. The flaw arises from the use of the unsafe binary_to_term/1 function when processing HTTP response bodies. An attacker who can control a package mirror or intercept network traffic can inject malicious Erlang terms, leading to:

• Denial of Service (DoS) via atom table exhaustion
• Potential Remote Code Execution (RCE) through object injection

CWE‑502 – Deserialization of Untrusted Data
CWE‑400 – Uncontrolled Resource Consumption

Attack Vector: Network

Exploit Status: Proof‑of‑Concept (PoC) available

Affected Components

Full CVE Report: CVE‑2026‑21619 details (external site) (replace with actual URL)