CVE-2026-23940

MediumCVSS 6.5/10Last modified Sep 8, 2026

Description

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation.

Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality.

This issue affects hex.pm: before 2026-03-10.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2026
Last modified: Sep 8, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-239419.4Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request CVE-2026-239425.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Tr CVE-2026-239435.3Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Serv CVE-2026-239449.8Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests coul CVE-2026-239466.8Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below i CVE-2026-239479.8Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.CVE-2026-239487.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logo CVE-2026-239498.6jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vul CVE-2026-23959.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology I CVE-2026-239505.9node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling CVE-2026-239515.5SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exa CVE-2026-239527.5ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointe