CVE-2026-23940 Denial of Service via Oversized Package Upload
Attackers can cause denial of service on Hex.pm by uploading oversized packages that exhaust server memory during extraction.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-23940?
CVE-2026-23940 is a high-severity denial of service vulnerability in hexpm, published on 13 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation.
Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality.
This issue affects hex.pm: before 2026-03-10.
Weakness: CWE-400
Which versions are affected by CVE-2026-23940?
It affects 1 product.
Products include Hex Hexpm.
How do I fix CVE-2026-23940?
No fix has been published for CVE-2026-23940 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23940 being exploited?
There is no known exploitation of CVE-2026-23940 in the wild and no public exploit code.
Other vulnerabilities in hexpm
- CVE-2026-21622 Password Reset Tokens Do Not Expire
- CVE-2026-21618 Cross-site scripting (XSS) in OAuth Device Authorization screen
- CVE-2026-21621 Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access
- CVE-2026-23939 Path Traversal in Local File Store Backend
Sources
Also known as EEF-CVE-2026-23940, GHSA-jp8w-gxf6-8hcr.