7.5

CVE-2026-21619: erlang rebar3 Uncontrolled Resource Consumption

CVSS: 7.5v3.1HighModified
AliasesMGASA-2026-0196UBUNTU-CVE-2026-21619DEBIAN-CVE-2026-21619
Published 27-02-2026Last modified 27-05-2026
Open JSON

Vulnerability summary

CVE-2026-21619 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in erlang rebar3. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.2% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
0.61%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 27-02-2026
    PublishedVulnerability first disclosed.
  2. 27-05-2026
    Last modifiedVulnerability information updated.

Description

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.

CVSS metrics

6 scores · 4 sources · 2 versions

EPSS trend

Probability

0.61%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

+0.03 pp

From 0.58% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.61%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • erlang-hexAll versions (No fix recorded) | < 2.4.2-2
  • rebar3All versions (No fix recorded) | < 3.27.0-1
Hex2 products
Hexpm2 products
  • hex≥ 314546ac432229518714cc8e3336e916b9da6305, < 636739f3322514e9303ca335fb630696fcbb3c95 | ≥ 2.3.0, < 2.3.2
  • hex_core≥ eb327f8edfe45507351e38cc0805aa12fa647f0b, < cdf726095bca85ad2549d146df1e831ae93c2b13 | ≥ 0.1.0, < 0.12.1
Mageia2 products
  • erlang-hex_core< 0.7.1-2.1.mga9
  • erlang-rebar3< 3.18.0-1.1.mga9
Erlang1 product
  • rebar3≥ 209c02ec57c2cc3207ee0174c3af3675b8dc8f79, < 1d4478f527e373de0b225951e53115450e0d9b9d | ≥ 3.9.1, < 3.27.0
Ubuntu1 product
  • rebar3All versions (No fix recorded)

6 vendors · 10 products

References

12 links
Show all 12 references