CVE-2026-96618: hex 0.11.2 to before 2.5.2

Affected technology

hex · 0.11.2 to before 2.5.2
hexpm

hex · 51ea632424fb6ea8765148f96dc25dfeb526b1f8 to before *; status changes: bb5189eade682c5fc3f98d9725973a7beb4e1deb — unaffected, 08956100a8283ba500a123e5539ac64d5d7e91d8 — unaffected
hexpm

Component: 'Elixir.Hex.HTTP', 'Elixir.Hex.SCM', 'Elixir.Mix.Tasks.Hex.Docs'
Function: 'Elixir.Hex.HTTP':request/5, 'Elixir.Hex.SCM':fetch/3, 'Elixir.Hex.SCM':update/1, 'Elixir.Mix.Tasks.Hex.Docs':run/1
File: lib/hex/http.ex, lib/hex/scm.ex, lib/mix/tasks/hex.docs.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality and integrity impact as none; availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.