Hex trusts its bundled CA certificates when cacerts_path is set

{
  "id": "55e9b64474e79c1e06252e16c2268f8baffd04b16017778bfd0dbf9372734982",
  "url": "https://osv.dev/vulnerability/EEF-CVE-2026-103503",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Hex trusts its bundled CA certificates when cacerts_path is set",
    "summary": "## Summary Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set `cacerts_path` to a CA store that leaves that CA out. `cacerts_path` (`HEX_CACERTS_PATH`) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. `Hex.HTTP.SSL.ssl_opts/1` passes the configured store as the `cacerts` option, but builds the `partial_chain` callback from the bundled store whether `cacerts_path` is set or not. `Hex.HTTP.SSL.partial_chain/2` accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies. This issue affects hex: from 0.20.2 before 2.5.2. ## Details 1. `Hex.HTTP.SSL.get_ca_certs/0` returns the certificates from `cacerts_path` when it's set, and `ssl_opts/1` passes them as `cacerts`. 2. `ssl_opts/1` sets `partial_chain` to `&partial_chain(Certs.cacerts(), &1)`, which always uses the bundled store. 3. When the server's chain doesn't lead to a certificate in `cacerts`, OTP calls `partial_chain` with the chain. `partial_chain/2` returns `{:trusted_ca, der}` for the first certificate whose public key matches a bundled CA certificate, and OTP validates the chain with that cer",
    "evidence": "osv:EEF-CVE-2026-103503",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "EEF-CVE-2026-103503",
      "aliases": [
        "CVE-2026-103503",
        "EEF-CVE-2026-103503",
        "GHSA-rw8q-hg7m-cxgr"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/hexpm/hex",
              "type": "GIT",
              "events": [
                {
                  "introduced": "c9b26a46928bfcd546773571e09c1d05f4cd9fb7"
                },
                {
                  "fixed": "5f5a2136c7cf5991b6e8a30d645ca9f8e74b0785"
                },
                {
                  "fixed": "6232a6498015e559743bec4f4fbec9138837cec8"
                }
              ]
            }
          ],
          "versions": [
            "v2.5.1",
            "v2.5.0",
            "v2.2.2",
            "v2.4.2",
            "v2.4.1",
            "v2.4.0",
            "v2.2.1",
            "v2.2.0",
            "v2.0.6",
            "v2.1.1",
            "v0.21.3",
            "v2.1.0",
            "v2.0.5",
            "v2.0.4",
            "v2.0.3",
            "v2.0.2",
            "v2.0.1",
            "v2.0.0",
            "v1.0.1",
            "v1.0.0",
            "v0.21.2",
            "v0.21.1",
            "v0.21.0",
            "v0.20.5",
            "v0.20.4",
            "v0.20.3",
            "v0.20.2"
          ],
          "database_specific": {
            "source": "https://cna.erlef.org/osv/EEF-CVE-2026-103503.json"
          }
        }
      ],
      "modified": "2026-10-12T15:41:14.757065180Z",
      "provider": "osv",
      "references": [
        "https://github.com/hexpm/hex/security/advisories/GHSA-rw8q-hg7m-cxgr",
        "https://cna.erlef.org/cves/CVE-2026-103503.html",
        "https://github.com/hexpm/hex/commit/c9b26a46928bfcd546773571e09c1d05f4cd9fb7",
        "https://github.com/hexpm/hex/commit/5f5a2136c7cf5991b6e8a30d645ca9f8e74b0785",
        "https://github.com/hexpm/hex/commit/6232a6498015e559743bec4f4fbec9138837cec8"
      ],
      "provider_metadata": {
        "cpe_ids": [
          "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"
        ],
        "cwe_ids": [
          "CWE-295"
        ],
        "capec_ids": [
          "CAPEC-94"
        ]
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-103503",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 300000,
  "published_at": "2026-10-12T15:17:45.545+00:00"
}