Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core     (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object     Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl,     src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4,     mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex:
    from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0. (CVE-2026-21619)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e67a6f9c45 advisory.

    hex_core ver. 0.12.2


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e6bf22d958 advisory.

    hex_core ver. 0.12.2


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
302196	Linux Distros Unpatched Vulnerability : CVE-2026-21619	Nessus	Misc.	Local	low
301446	Fedora 43 : erlang-hex_core (2026-e67a6f9c45)	Nessus	Fedora Local Security Checks	Local	low
301436	Fedora 44 : erlang-hex_core (2026-e6bf22d958)	Nessus	Fedora Local Security Checks	Local	low

Detections

Analytics

CVE-2026-21619

low

Tenable Plugins

low

low

low