hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating system's CA certificates can't be loaded. hex_core:default_config/0 selects the built-in hex_http_httpc adapter. For an HTTPS request whose adapter config has no ssl option, hex_http_httpc:http_options/2 builds options that verify the server certificate against public_key:cacerts_get/0. When that call raises, the adapter prints a warning and sends the request without ssl options, so httpc uses the defaults of the ssl application, which before OTP 26 don't verify the server certificate. public_key:cacerts_get/0 doesn't exist on OTP 24, so every HTTPS request falls back there, and on OTP 25 it raises when no CA store is found. hex_core versions before 0.11.0 never set ssl options, so they don't verify the server certificate on OTP 25 and earlier whether or not a CA store is found. The fallback was intended and documented, but the documentation didn't make clear that it meant no certificate verification. Since hex_core 0.8.2 the README has warned that the built-in httpc adapter "has insecure default settings" and recommended other HTTP clients, and the adapter prints "using default ssl options which are insecure" on every request that falls back. hex_core 0.11.0 added certificate verificat
CVE-2026-103502
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-103502
hex_core
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
hex_core
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/hexpm/hex_core",
"vendor": "hexpm",
"modules": [
"hex_http_httpc"
],
"product": "hex_core",
"versions": [
{
"status": "affected",
"version": "0.1.0",
"lessThan": "0.20.0",
"versionType": "semver"
}
],
"packageURL": "pkg:hex/hex_core",
"packageName": "hex_core",
"programFiles": [
"src/hex_http_httpc.erl"
],
"collectionURL": "https://repo.hex.pm",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "hex_http_httpc:request/5"
},
{
"name": "hex_http_httpc:request_to_file/6"
}
]
},
{
"cpes": [
"cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/hexpm/hex_core",
"vendor": "hexpm",
"modules": [
"hex_http_httpc"
],
"product": "hex_core",
"versions": [
{
"status": "affected",
"version": "fbb6d9de472e5edb8d6fb6b32a91cb266137892e",
"lessThan": "b7b3a42defb4ed8e20a5c68a4412ce68a95b7938",
"versionType": "git"
}
],
"packageURL": "pkg:github/hexpm/hex_core",
"packageName": "hexpm/hex_core",
"programFiles": [
"src/hex_http_httpc.erl"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "hex_http_httpc:request/5"
},
{
"name": "hex_http_httpc:request_to_file/6"
}
]
}
]- Related CVEs
- CVE-2026-103502
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #32757 · Revision 1
- Added to Heist Feed
- Publisher date