Hexpm Hex Core vulnerabilities

• erlang otp, rebar3, hexpm hex +1 more +3 more erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole CVE-2026-96596 Fix available 5.9 MediumOctober 14, 2026
• erlang rebar3, hexpm hex, hex core +2 more hex_core decompresses registry and Erlang term API responses without size limits CVE-2026-105274 Fix available 2.1 LowOctober 12, 2026
• hexpm hex core hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 CVE-2026-103502 Fix available 5.9 MediumOctober 12, 2026
• erlang rebar3, hex, hex core +1 more +3 more Unsafe Deserialization of Erlang Terms in hex_core CVE-2026-21619 Fix available 2.0 LowFebruary 27, 2026