CVE-2026-103503 Affecting erlang-hex package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ECHOLATEST-ERLANGHEX-21172985
- published17 Oct 2026
- disclosed12 Oct 2026
Introduced: 12 Oct 2026
NewCVE-2026-103503 (opens in a new tab)How to fix?
There is no fixed version for Echo:latest erlang-hex.
NVD Description
Note: Versions mentioned in the description apply only to the upstream erlang-hex package and not the erlang-hex package as distributed by Echo.
See How to fix? for Echo:latest relevant fixed versions and status.
Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out.
cacerts_path (HEX_CACERTS_PATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.ssl_opts/1 passes the configured store as the cacerts option, but builds the partial_chain callback from the bundled store whether cacerts_path is set or not. Hex.HTTP.SSL.partial_chain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies.
This issue affects hex: from 0.20.2 before 2.5.2.
References
- https://advisory.echohq.com/cve/CVE-2026-103503
- https://cna.erlef.org/cves/CVE-2026-103503.html
- https://github.com/hexpm/hex/commit/5f5a2136c7cf5991b6e8a30d645ca9f8e74b0785
- https://github.com/hexpm/hex/commit/6232a6498015e559743bec4f4fbec9138837cec8
- https://github.com/hexpm/hex/commit/c9b26a46928bfcd546773571e09c1d05f4cd9fb7
- https://github.com/hexpm/hex/security/advisories/GHSA-rw8q-hg7m-cxgr
- https://osv.dev/vulnerability/EEF-CVE-2026-103503