CVE-2026-103503: hex 0.20.2 to before 2.5.2

Affected technology

hex · 0.20.2 to before 2.5.2
hexpm

hex · c9b26a46928bfcd546773571e09c1d05f4cd9fb7 to before *; status changes: 5f5a2136c7cf5991b6e8a30d645ca9f8e74b0785 — unaffected, 6232a6498015e559743bec4f4fbec9138837cec8 — unaffected
hexpm

Component: 'Elixir.Hex.HTTP.SSL'
Function: 'Elixir.Hex.HTTP.SSL':ssl_opts/1, 'Elixir.Hex.HTTP.SSL':partial_chain/2
File: lib/hex/http/ssl.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 5.9/10) rates confidentiality impact as high; integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.