CVE-2026-103503

CVE-2026-103503 · Hex trusts its bundled CA certificates when cacerts_path is set

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out. cacerts_path (HEX_CACERTS_PATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.ssl_opts/1 passes the configured store as the cacerts option, but builds the partial_chain callback from the bundled store whether cacerts_path is set or not. Hex.HTTP.SSL.partial_chain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies. This issue affects hex: from 0.20.2 before 2.5.2.

CVSS 5.9 · Medium · EPSS 0.2% · Fix available

Published

2026-10-12T15:17:45.545Z

Updated

2026-10-16T17:32:45.735Z

Stack: system

Check your server →