← Vulnerability feed

Vulnerability record · CVE-2026-21619 · published 27 February 2026

CVE-2026-21619: Erlang rebar3 uncontrolled resource consumption vulnerability

Erlang · Rebar3

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.

2.0 CVSS 4.0 Low EPSS 0.60% · top 53.6% CWE-400 · Uncontrolled resource consumptionCWE-502 · Deserialization of untrusted data
2.0CVSS 4.0 base score
0.60%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cna.erlef.org/cves/CVE-2026-21619.html
https://github.com/erlang/rebar3/commit/1d4478f527e373de0b225951e53115450e0d9b9d Patch
https://github.com/hexpm/hex/commit/636739f3322514e9303ca335fb630696fcbb3c95 Patch
https://github.com/hexpm/hex_core/commit/cdf726095bca85ad2549d146df1e831ae93c2b13 Patch
https://github.com/hexpm/hex_core/security/advisories/GHSA-hx9w-f2w9-9g96 MitigationVendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-21619

Track CVE-2026-21619 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-13802Erlang rebar3 os command injection vulnerabilityRebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.EPSS 6.8%8.9CVE-2026-32148Hex download of code without integrity check vulnerabilityInsufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverif…EPSS 0.26%8.8CVE-2019-1000012Hex insufficient verification of data authenticity vulnerabilityHex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package…EPSS 0.88%8.8CVE-2019-1000013Hex core insufficient verification of data authenticity vulnerabilityHex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Pa…EPSS 0.88%8.8CVE-2019-1000014Erlang rebar3 vulnerabilityErlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package mod…EPSS 1.8%7.5CVE-2026-28318SolarWinds Serv-U unauthenticated POST request denial of serviceSolarWinds Serv-U crashes when it receives a specially crafted POST request using Content-Encoding: deflate, and the crash occurs without authenticat…KEVEPSS 1.9%analysed7.5CVE-2026-45498Microsoft Defender antimalware platform uncontrolled resource consumption DoSCVE-2026-45498 is a denial of service flaw in the Microsoft Defender antimalware platform, classified as uncontrolled resource consumption (CWE-400).…KEVEPSS 1.3%analysed7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2026-21619), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.