Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.9 | Medium | 4.0 | CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | CNA (EEF) |
- CISA KEV Not listed.
- EPSS 0.0021, the 11th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:25 UTC First seen by agentprime
- 31 Oct 2026, 15:25 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-phm5-m6cj-5382
- OSV: GHSA-phm5-m6cj-5382
- github.com/erlang/otp/security/advisories/GHSA-phm5-m6cj-5382
- cna.erlef.org/cves/CVE-2026-96596.html
- www.erlang.org/doc/system/versions.html#order-of-versions
- github.com/erlang/rebar3/commit/23dbdb5d1f87f56902aef296c88a20049cd0c6e4
- github.com/erlang/rebar3/commit/310e2ec8c7dd3df05d67af2b7fae23f30fc523c4
- github.com/hexpm/hex_core/commit/13bb9fbba418a406af614790b8d5cd458259ee70
- github.com/hexpm/hex_core/commit/a2ece683e6e88a3ec95ad20b09aca426e08b372e
- github.com/erlang/otp/commit/fbf2c7194f6fce4b7b66dc0bcaa4f6b4b85e088f
- github.com/erlang/otp/commit/3086307f311b78b38644a7787a3aca6a3f95a9d5
- github.com/hexpm/hex/commit/5543a1919c709d8eb2b317f62aad76ca1eed375c
- github.com/hexpm/hex/commit/8e1067131a13949eff30623f31648a945ffd5418
- github.com/hexpm/hex/commit/7847c23d09ab52113614c3718e1e7d368743da5d