What is CVE-2026-21619?

CVE-2026-21619 is a high-severity vulnerability in Erlang Rebar3, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-02-27.

How severe is CVE-2026-21619?

High severity. CVSS v3 base score is 7.5 out of 10.

Deserialization in Erlang Rebar3

CVE-2026-21619

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This…

Vulnerability class: DoS (Denial of Service)

EPSS: 0.006 (43.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Erlang Rebar3 — versions 209c02ec57c2cc3207ee0174c3af3675b8dc8f79, 3.9.1
Hex
Hex Hex_core
Hexpm Hex — versions 314546ac432229518714cc8e3336e916b9da6305, 2.3.0
Hexpm Hex_core — versions eb327f8edfe45507351e38cc0805aa12fa647f0b, 0.1.0

Weakness classification (CWE)

References

6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related, vendor-advisory, Mitigation, Vendor Advisory)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (Patch, patch)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (Patch, patch)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (Patch, patch)

Frequently asked questions

What is CVE-2026-21619?: CVE-2026-21619 is a high-severity vulnerability in Erlang Rebar3, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-02-27.
How severe is CVE-2026-21619?: High severity. CVSS v3 base score is 7.5 out of 10.