CVE-2026-103503

CVE-2026-103503 · Hex trusts its bundled CA certificates when cacerts_path is set

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out. cacerts_path (HEX_CACERTS_PATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.ssl_opts/1 passes the configured store as the cacerts option, but builds the partial_chain callback from the bundled store whether cacerts_path is set or not. Hex.HTTP.SSL.partial_chain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies. This issue affects hex: from 0.20.2 before 2.5.2.

CVSS 5.9 · Media · EPSS 0,2% · Corrección disponible

Publicación

2026-10-12T15:17:45.545Z

Actualización

2026-10-16T17:32:45.735Z

Pila tecnológica: system

Comprueba tu servidor →