CVE-2026-103502
Description
A flaw was found in hex_core. A network attacker capable of intercepting network traffic can impersonate remote package repositories and Application Programming Interface (API) servers due to improper certificate validation in the default HTTP adapter. When certificate verification cannot be completed or system root certificates are unavailable, the adapter falls back to insecure connection defaults rather than aborting the request. Consequently, an attacker can capture sensitive information such as authentication credentials and API keys, or alter transmitted data.
Statement
A moderate-impact vulnerability was found in hex_core, the Erlang/Elixir client library for the Hex package repository. hex_core's default HTTP adapter, hex_http_httpc, does not verify TLS server certificates when running on Erlang/OTP 24, or on OTP 25 when the operating system's CA certificates cannot be loaded: when the adapter cannot build certificate-verification options, it falls back to the ssl application's insecure connection defaults rather than aborting the request. A network attacker able to intercept HTTPS connections could exploit this to impersonate hex.pm or other repository and API servers, capture sensitive information sent by client programs such as API keys, OAuth tokens, and repository keys, and alter API requests and responses. Registry signatures, which hex_core verifies by default, still prevent changes to registry package contents, so package contents cannot be tampered with. Red Hat rates this flaw as Moderate severity, consistent with the upstream Medium rating. No Red Hat products are currently listed as affected by this flaw.
Mitigation
Users of the default hex_http_httpc adapter can work around this issue by configuring SSL options that verify the server certificate (for example, verify_peer with a trusted CA certificate store) in the adapter's http_options, such as {hex_http_httpc, #{http_options => [{ssl, SslOpts}]}}, by using an alternative HTTP adapter that performs certificate verification, or by running on Erlang/OTP 26 or later, where the ssl application verifies server certificates by default. Upgrading hex_core to version 0.20.0 or later, where HTTPS requests fail rather than fall back to insecure defaults when CA certificates are unavailable, resolves the issue.
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
