{"affected":[{"defaultStatus":"unaffected","ecosystem":"otp","packageName":"hex","product":"hex","source":"CNA: EEF","vendor":"hexpm","versions":[{"lessThan":"2.5.2","status":"affected","version":"0.20.2","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"github","packageName":"hexpm/hex","product":"hex","source":"CNA: EEF","vendor":"hexpm","versions":[{"changes":[{"at":"5f5a2136c7cf5991b6e8a30d645ca9f8e74b0785","status":"unaffected"},{"at":"6232a6498015e559743bec4f4fbec9138837cec8","status":"unaffected"}],"lessThan":"*","status":"affected","version":"c9b26a46928bfcd546773571e09c1d05f4cd9fb7","versionType":"git"}]}],"cveId":"CVE-2026-103503","cwes":["CWE-295"],"description":"Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out.\n\ncacerts_path (HEX_CACERTS_PATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.ssl_opts/1 passes the configured store as the cacerts option, but builds the partial_chain callback from the bundled store whether cacerts_path is set or not. Hex.HTTP.SSL.partial_chain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies.\n\nThis issue affects hex: from 0.20.2 before 2.5.2.","epss":{"date":"2026-11-10","percentile":0.10848,"score":0.00207},"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: EEF","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794405894738,"publishedAt":1791818265545,"references":[{"source":"CNA: EEF","tags":["related","vendor-advisory"],"url":"https://github.com/hexpm/hex/security/advisories/GHSA-rw8q-hg7m-cxgr"},{"source":"CNA: EEF","tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-103503.html"},{"source":"CNA: EEF","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-103503"},{"source":"CNA: EEF","tags":["related"],"url":"https://github.com/hexpm/hex/commit/c9b26a46928bfcd546773571e09c1d05f4cd9fb7"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/hexpm/hex/commit/5f5a2136c7cf5991b6e8a30d645ca9f8e74b0785"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/hexpm/hex/commit/6232a6498015e559743bec4f4fbec9138837cec8"}],"remediation":[{"kind":"fix","source":"CNA: EEF","text":"Upgrade Hex to 2.5.2 or later, for example with mix local.hex. With cacerts_path (HEX_CACERTS_PATH) set, Hex then only accepts server certificates that chain to a CA in that file, and it doesn't trust copies of CA certificates sent by the server."},{"kind":"workaround","source":"CNA: EEF","text":"There's no Hex configuration that stops the bundled CAs from being trusted."},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/hexpm/hex/commit/5f5a2136c7cf5991b6e8a30d645ca9f8e74b0785"},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/hexpm/hex/commit/6232a6498015e559743bec4f4fbec9138837cec8"}],"revision":"a26bede0c059a51c4830fc63ccda5ea0fadc72ab7782e3ecc9b6f76bb5b81ba6","sources":[{"modifiedAt":1794405894738,"name":"CNA: EEF","retrievedAt":1794409701205,"url":"https://www.cve.org/CVERecord?id=CVE-2026-103503"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794409727606,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103503"}],"ssvc":{"assessedAt":1792171853768,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Hex trusts its bundled CA certificates when cacerts_path is set","updatedAt":1794409727606}