CVE-2026-32148 Details
Description
Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums. Hex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned by Hex.Utils.lock/1 uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected. An attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The mix.lock file is silently rewritten with the checksum values from the registry, erasing evidence of tampering. This issue affects hex: from 0.16.0 before 2.4.2.
A vulnerability in the Hex package manager, specifically in versions 0.16.0 prior to 2.4.2, allows for a bypass of dependency integrity checks. This issue arises in the Hex.RemoteConverger module, where the verification of lockfile checksums is improperly handled. The lockfile, mix.lock, is intended to ensure reproducible builds by storing checksums for dependencies. However, the verification process is flawed: it compares atom-based dependency names against string-based names in the lockfile, leading to a silent omission of checksum checks. While checksums are validated when packages are downloaded from the registry, discrepancies between the lockfile and resolved dependencies go undetected. This vulnerability could be exploited by an attacker who can manipulate cached packages, such as through local cache poisoning or a compromised registry, to introduce modified dependency contents that are accepted without scrutiny. The mix.lock file would then be updated with the tampered checksum values, erasing any trace of the modification.
Users can update to Hex version 2.4.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v | CISA-ADP | ExploitPatchVendor Advisory |
| https://cna.erlef.org/cves/CVE-2026-32148.html | EEF | Third Party Advisory |
| https://github.com/hexpm/hex/commit/d7528c8199a1144511508bf3a6460026a5a14c8e | EEF | Patch |
| https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v | EEF | ExploitPatchVendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-32148 | EEF | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-354 | Improper Validation of Integrity Check Value | EEF |
| CWE-494 | Download of Code Without Integrity Check | EEF |
Affected Products
| Product | Versions |
|---|---|
| hex hex | >= 0.16.0, < 2.4.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | Initial Analysis | [email protected] |
| Apr 30, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | New CVE Received | EEF |