Hex trusts its bundled CA certificates when cacerts_path is set
Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out. cacerts_path (HEX_CACERTS_PATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.ssl_opts/1 passes the configured store as the cacerts option, but builds the partial_chain callback from the bundled store whether cacerts_path is set or not. Hex.HTTP.SSL.partial_chain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies. This issue affects hex: from 0.20.2 before 2.5.2.
CVE-2026-103503
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-103503
hex
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
hex
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/hexpm/hex",
"vendor": "hexpm",
"modules": [
"'Elixir.Hex.HTTP.SSL'"
],
"product": "hex",
"versions": [
{
"status": "affected",
"version": "0.20.2",
"lessThan": "2.5.2",
"versionType": "semver"
}
],
"packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git",
"packageName": "hex",
"programFiles": [
"lib/hex/http/ssl.ex"
],
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Hex.HTTP.SSL':ssl_opts/1"
},
{
"name": "'Elixir.Hex.HTTP.SSL':partial_chain/2"
}
]
},
{
"cpes": [
"cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/hexpm/hex",
"vendor": "hexpm",
"modules": [
"'Elixir.Hex.HTTP.SSL'"
],
"product": "hex",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "5f5a2136c7cf5991b6e8a30d645ca9f8e74b0785",
"status": "unaffected"
},
{
"at": "6232a6498015e559743bec4f4fbec9138837cec8",
"status": "unaffected"
}
],
"version": "c9b26a46928bfcd546773571e09c1d05f4cd9fb7",
"lessThan": "*",
"versionType": "git"
}
],
"packageURL": "pkg:github/hexpm/hex",
"packageName": "hexpm/hex",
"programFiles": [
"lib/hex/http/ssl.ex"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Hex.HTTP.SSL':ssl_opts/1"
},
{
"name": "'Elixir.Hex.HTTP.SSL':partial_chain/2"
}
]
}
]- Related CVEs
- CVE-2026-103503
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #32874 · Revision 1
- Added to Heist Feed
- Publisher date