# Hex Advisories.

Every Hex Advisory we hold (Elixir · Erlang), newest first.

## Records, newest first (an older page)

- [Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex](https://agentprime.io/advisories/GHSA-3w4f-53g2-f66p.md)
  `GHSA-3w4f-53g2-f66p`, `CVE-2026-54888`, `EEF-CVE-2026-54888` · Hex `mdex` and 1 more: affected `>=0.3.0, <0.12.3`, fixed in `0.12.3` · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Denial of service
- [Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service](https://agentprime.io/advisories/GHSA-cmvp-gp9f-23xw.md)
  `GHSA-cmvp-gp9f-23xw`, `CVE-2026-53429`, `EEF-CVE-2026-53429` · Hex `mdex` and 1 more: affected `>=0.11.0, <0.12.3`, fixed in `0.12.3` · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Denial of service
- [Unbounded memory allocation in highlight_lines range expansion in mdex](https://agentprime.io/advisories/GHSA-j93q-9cvj-rxfm.md)
  `GHSA-j93q-9cvj-rxfm`, `CVE-2026-53428`, `EEF-CVE-2026-53428` · Hex `mdex` and 1 more: affected `>=0.11.0, <0.12.3`, fixed in `0.12.3` · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Denial of service
- [Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute](https://agentprime.io/advisories/GHSA-v664-pmxr-mxxx.md)
  `GHSA-v664-pmxr-mxxx`, `CVE-2026-53427`, `EEF-CVE-2026-53427` · Hex `mdex` and 1 more: affected `>=0.11.3, <0.12.3`, fixed in `0.12.3` · CVSS 2.3 Low · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Relyra SAML SignatureValue not cryptographically verified -> authentication bypass](https://agentprime.io/advisories/GHSA-jv46-xfwm-36j7.md)
  `GHSA-jv46-xfwm-36j7`, `CVE-2026-49454` · Hex `relyra`: affected `>=1.0.0, <1.2.0`, fixed in `1.2.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Stored XSS via unescaped HTML attribute values in earmark](https://agentprime.io/advisories/GHSA-52mm-h59v-f3c7.md)
  `GHSA-52mm-h59v-f3c7`, `CVE-2026-48591`, `EEF-CVE-2026-48591` · Hex `earmark`: affected `>=1.4.1`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc](https://agentprime.io/advisories/GHSA-grp7-v8xh-rj7h.md)
  `GHSA-grp7-v8xh-rj7h`, `CVE-2026-48853`, `EEF-CVE-2026-48853` · Hex `grpc`: affected `>=0.4.0, <1.0.0`, fixed in `1.0.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization, Denial of service
- [Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding](https://agentprime.io/advisories/GHSA-mwr4-5g34-j5cq.md)
  `GHSA-mwr4-5g34-j5cq`, `CVE-2026-48599`, `EEF-CVE-2026-48599` · Hex `grpc`: affected `>=0.8.0, <1.0.0`, fixed in `1.0.0` · CVSS 7.6 High · Not analysed yet · Published 15 Jun 2026 · Tags: Broken access control
- [Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc](https://agentprime.io/advisories/GHSA-q8gf-9rvj-gmgj.md)
  `GHSA-q8gf-9rvj-gmgj`, `CVE-2026-48854`, `EEF-CVE-2026-48854` · Hex `grpc`: affected `>=0.3.0-alpha.2, <1.0.0`, fixed in `1.0.0` · CVSS 8.7 High · Not analysed yet · Published 15 Jun 2026 · Tags: Denial of service
- [HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2](https://agentprime.io/advisories/GHSA-w4f7-4cxr-rv3c.md)
  `GHSA-w4f7-4cxr-rv3c`, `CVE-2026-43966`, `EEF-CVE-2026-43966` · Hex `cowlib`: affected `>=2.9.0`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection
- [Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies](https://agentprime.io/advisories/GHSA-655f-mp8p-96gv.md)
  `GHSA-655f-mp8p-96gv`, `CVE-2026-49755`, `EEF-CVE-2026-49755` · Hex `req`: affected `>=0.1.0, <0.6.1`, fixed in `0.6.1` · CVSS 8.2 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-409
- [Multipart form-data header injection in Req via unescaped name/filename/content_type](https://agentprime.io/advisories/GHSA-px9f-whj3-246m.md)
  `GHSA-px9f-whj3-246m`, `CVE-2026-49756`, `EEF-CVE-2026-49756` · Hex `req`: affected `>=0.5.3, <0.6.0`, fixed in `0.6.0` · CVSS 2.1 Low · Not analysed yet · Published 8 Jun 2026 · Tags: Other injection
- [gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion](https://agentprime.io/advisories/GHSA-r53j-fjj5-mv77.md)
  `GHSA-r53j-fjj5-mv77`, `CVE-2026-43973`, `EEF-CVE-2026-43973` · Hex `gun`: affected `>=1.0.0, <2.4.0`, fixed in `2.4.0` · CVSS 8.7 High · Not analysed yet · Published 8 Jun 2026 · Tags: Denial of service
- [gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection](https://agentprime.io/advisories/GHSA-36w4-95hv-5vwg.md)
  `GHSA-36w4-95hv-5vwg`, `CVE-2026-43972`, `EEF-CVE-2026-43972` · Hex `gun`: affected `>=2.0.0, <2.4.0`, fixed in `2.4.0` · CVSS 6.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-346
- [gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM](https://agentprime.io/advisories/GHSA-2j82-37xg-f9wp.md)
  `GHSA-2j82-37xg-f9wp`, `CVE-2026-43974`, `EEF-CVE-2026-43974` · Hex `gun`: affected `>=2.0.0, <2.4.0`, fixed in `2.4.0` · CVSS 8.7 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-841
- [CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection](https://agentprime.io/advisories/GHSA-q7jx-v53g-848w.md)
  `GHSA-q7jx-v53g-848w`, `CVE-2026-48596`, `EEF-CVE-2026-48596` · Hex `tesla`: affected `>=0.8.0, <1.18.3`, fixed in `1.18.3` · CVSS 2.1 Low · Not analysed yet · Published 2 Jun 2026 · Tags: Other injection
- [Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression](https://agentprime.io/advisories/GHSA-mc85-72gr-vm9f.md)
  `GHSA-mc85-72gr-vm9f`, `CVE-2026-48594`, `EEF-CVE-2026-48594` · Hex `tesla`: affected `>=0.6.0, <1.18.3`, fixed in `1.18.3` · CVSS 8.2 High · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-409
- [Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects](https://agentprime.io/advisories/GHSA-9m9w-gxf7-rh8m.md)
  `GHSA-9m9w-gxf7-rh8m`, `CVE-2026-48595`, `EEF-CVE-2026-48595` · Hex `tesla`: affected `>=1.4.0, <1.18.3`, fixed in `1.18.3` · CVSS 8.2 High · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-178
- [Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint](https://agentprime.io/advisories/GHSA-h74c-q9j7-mpcm.md)
  `GHSA-h74c-q9j7-mpcm`, `CVE-2026-48597`, `EEF-CVE-2026-48597` · Hex `tesla`: affected `>=1.3.0, <1.18.3`, fixed in `1.18.3` · CVSS 8.2 High · Not analysed yet · Published 2 Jun 2026 · Tags: Denial of service
- [CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection](https://agentprime.io/advisories/GHSA-28jh-g32x-v9v4.md)
  `GHSA-28jh-g32x-v9v4`, `CVE-2026-48598`, `EEF-CVE-2026-48598` · Hex `tesla`: affected `>=0.8.0, <1.18.3`, fixed in `1.18.3` · CVSS 2.1 Low · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-116
- [HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing](https://agentprime.io/advisories/GHSA-mjqx-c6f6-7rc2.md)
  `GHSA-mjqx-c6f6-7rc2`, `CVE-2026-49753`, `EEF-CVE-2026-49753` · Hex `mint`: affected `>=0.1.0, <1.9.0`, fixed in `1.9.0` · CVSS 6.3 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: HTTP request smuggling
- [HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation](https://agentprime.io/advisories/GHSA-2p26-p43x-fhp8.md)
  `GHSA-2p26-p43x-fhp8`, `CVE-2026-49754`, `EEF-CVE-2026-49754` · Hex `mint`: affected `>=0.1.0, <1.9.0`, fixed in `1.9.0` · CVSS 8.2 High · Not analysed yet · Published 2 Jun 2026 · Tags: Denial of service
- [Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency](https://agentprime.io/advisories/GHSA-g586-ccqf-7x4r.md)
  `GHSA-g586-ccqf-7x4r`, `CVE-2026-48862`, `EEF-CVE-2026-48862` · Hex `mint`: affected `>=0.2.0, <1.9.0`, fixed in `1.9.0` · CVSS 8.2 High · Not analysed yet · Published 2 Jun 2026 · Tags: Denial of service
- [CRLF injection in HTTP/1 request line via unvalidated method in Mint](https://agentprime.io/advisories/GHSA-2pg6-44cx-c49v.md)
  `GHSA-2pg6-44cx-c49v`, `CVE-2026-48861`, `EEF-CVE-2026-48861` · Hex `mint`: affected `>=0.1.0, <1.9.0`, fixed in `1.9.0` · CVSS 2.1 Low · Not analysed yet · Published 2 Jun 2026 · Tags: Other injection
- [ex_aws_sns SigningCertURL not validated in verify_message/1](https://agentprime.io/advisories/GHSA-8jgf-23q5-x7xx.md)
  `GHSA-8jgf-23q5-x7xx`, `CVE-2026-47074`, `EEF-CVE-2026-47074` · Hex `ex_aws_sns`: affected `>=2.0.1, <2.3.5`, fixed in `2.3.5` · CVSS 8.7 High · Not analysed yet · Published 28 May 2026 · Tags: Weak cryptography or TLS
- [Missing authorization check on save-job event handler in oban_web](https://agentprime.io/advisories/GHSA-389x-rgxr-8m33.md)
  `GHSA-389x-rgxr-8m33`, `CVE-2026-48592`, `EEF-CVE-2026-48592` · Hex `oban_web`: affected `>=2.12.0, <2.12.5`, fixed in `2.12.5` · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Broken access control
- [Unbounded range expansion in cron describe causes memory exhaustion in oban_web](https://agentprime.io/advisories/GHSA-6xh2-93p9-vqh4.md)
  `GHSA-6xh2-93p9-vqh4`, `CVE-2026-48593`, `EEF-CVE-2026-48593` · Hex `oban_web`: affected `>=2.12.0, <2.12.5`, fixed in `2.12.5` · CVSS 5.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Denial of service
- [Duplicate Advisory: Hackney has an Allocation of Resources Without Limits or Throttling vulnerabilit](https://agentprime.io/advisories/GHSA-76v6-f83q-pxvh.md)
  `GHSA-76v6-f83q-pxvh` · Hex `hackney`: affected `>=2.0.0, <4.0.1`, fixed in `4.0.1` · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 26 May 2026 · Tags: Denial of service
- [Unbounded memory consumption in WebSocket client in hackney](https://agentprime.io/advisories/GHSA-q8jg-fgj4-fphf.md)
  `GHSA-q8jg-fgj4-fphf`, `CVE-2026-47073`, `EEF-CVE-2026-47073` · Hex `hackney`: affected `>=2.0.0, <4.0.1`, fixed in `4.0.1` · CVSS 8.7 High · Not analysed yet · Published 25 May 2026 · Tags: Denial of service
- [Atom table exhaustion via unrecognized URL schemes in hackney](https://agentprime.io/advisories/GHSA-9653-rcfr-5c62.md)
  `GHSA-9653-rcfr-5c62`, `CVE-2026-47067`, `EEF-CVE-2026-47067` · Hex `hackney`: affected `>=2.0.0, <4.0.1`, fixed in `4.0.1` · CVSS 8.7 High · Not analysed yet · Published 25 May 2026 · Tags: Denial of service
- [CRLF injection in WebSocket upgrade request in hackney](https://agentprime.io/advisories/GHSA-f9vr-g2g2-x9fg.md)
  `GHSA-f9vr-g2g2-x9fg`, `CVE-2026-47072`, `EEF-CVE-2026-47072` · Hex `hackney`: affected `>=2.0.0, <4.0.1`, fixed in `4.0.1` · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection
- [SSRF allowlist bypass via percent-encoded host in hackney](https://agentprime.io/advisories/GHSA-pj7v-xfvx-wmjq.md)
  `GHSA-pj7v-xfvx-wmjq`, `CVE-2026-47076`, `EEF-CVE-2026-47076` · Hex `hackney`: affected `>=0.13.0, <4.0.1`, fixed in `4.0.1` · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Server-side request forgery (SSRF), CWE-436
- [HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney](https://agentprime.io/advisories/GHSA-h73q-4w9q-82h4.md)
  `GHSA-h73q-4w9q-82h4`, `CVE-2026-47070`, `EEF-CVE-2026-47070` · Hex `hackney`: affected `>=3.1.1, <4.0.1`, fixed in `4.0.1` · CVSS 6.0 Medium · Not analysed yet · Published 25 May 2026 · Tags: Open redirect
- [CR/LF injection in query parameter in hackney](https://agentprime.io/advisories/GHSA-j9wq-vxxc-94wf.md)
  `GHSA-j9wq-vxxc-94wf`, `CVE-2026-47075`, `EEF-CVE-2026-47075` · Hex `hackney`: affected `>=0.13.1, <4.0.1`, fixed in `4.0.1` · CVSS 6.8 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection
- [Unbounded body accumulation in HTTP/3 response loop in hackney](https://agentprime.io/advisories/GHSA-jq4m-q6p2-8gwc.md)
  `GHSA-jq4m-q6p2-8gwc`, `CVE-2026-47077`, `EEF-CVE-2026-47077` · Hex `hackney`: affected `>=2.0.0, <4.0.1`, fixed in `4.0.1` · CVSS 8.2 High · Not analysed yet · Published 25 May 2026 · Tags: Denial of service
- [SOCKS5 TLS upgrade ignores caller timeout in hackney](https://agentprime.io/advisories/GHSA-gp9c-pm5m-5cxr.md)
  `GHSA-gp9c-pm5m-5cxr`, `CVE-2026-47071`, `EEF-CVE-2026-47071` · Hex `hackney`: affected `>=0.10.0, <4.0.1`, fixed in `4.0.1` · CVSS 8.2 High · Not analysed yet · Published 25 May 2026 · Tags: Denial of service
- [Infinite loop in Alt-Svc header parser in hackney](https://agentprime.io/advisories/GHSA-6cp8-v795-jr2j.md)
  `GHSA-6cp8-v795-jr2j`, `CVE-2026-47066`, `EEF-CVE-2026-47066` · Hex `hackney`: affected `>=2.0.0-beta.1, <4.0.1`, fixed in `4.0.1` · CVSS 8.7 High · Not analysed yet · Published 25 May 2026 · Tags: Denial of service
- [CRLF injection in cookie domain/path options in hackney](https://agentprime.io/advisories/GHSA-mp55-p8c9-rfw2.md)
  `GHSA-mp55-p8c9-rfw2`, `CVE-2026-47069`, `EEF-CVE-2026-47069` · Hex `hackney`: affected `>=0.9.0, <4.0.1`, fixed in `4.0.1` · CVSS 2.1 Low · Not analysed yet · Published 25 May 2026 · Tags: Other injection
- [Cross-session PubSub topic injection via URL parameter in phoenix_storybook](https://agentprime.io/advisories/GHSA-mrhx-6pw9-q5fh.md)
  `GHSA-mrhx-6pw9-q5fh`, `CVE-2026-47068`, `EEF-CVE-2026-47068` · Hex `phoenix_storybook`: affected `>=0.4.0, <1.1.0`, fixed in `1.1.0` · CVSS 2.3 Low · Not analysed yet · Published 20 May 2026 · Tags: Broken access control
- [Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground](https://agentprime.io/advisories/GHSA-55hg-8qxv-qj4p.md)
  `GHSA-55hg-8qxv-qj4p`, `CVE-2026-8467`, `EEF-CVE-2026-8467` · Hex `phoenix_storybook`: affected `>=0.5.0, <1.1.0`, fixed in `1.1.0` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 May 2026 · Tags: Code injection
- [Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook](https://agentprime.io/advisories/GHSA-833p-95jq-929q.md)
  `GHSA-833p-95jq-929q`, `CVE-2026-8469`, `EEF-CVE-2026-8469` · Hex `phoenix_storybook`: affected `>=0.2.0, <1.1.0`, fixed in `1.1.0` · CVSS 8.2 High · Not analysed yet · Published 20 May 2026 · Tags: Denial of service
- [Unbounded buffer accumulation in multipart header parsing causes denial of service in plug](https://agentprime.io/advisories/GHSA-468c-vq7p-gh64.md)
  `GHSA-468c-vq7p-gh64`, `CVE-2026-8468`, `EEF-CVE-2026-8468` · Hex `plug`: affected `>=1.4.0, <1.15.4 || >=1.16.0, <1.16.3 || >=1.17.0, <1.17.1 || >=1.18.0, <1.18.2 || >=1.19.0, <1.19.2`, fixed in `1.15.4`, `1.16.3`, `1.17.1`, `1.18.2`, `1.19.2` · CVSS 8.2 High · Not analysed yet · Published 14 May 2026 · Tags: Denial of service
- [Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame](https://agentprime.io/advisories/GHSA-84f2-rp86-235p.md)
  `GHSA-84f2-rp86-235p`, `CVE-2026-43970`, `EEF-CVE-2026-43970` · Hex `cowlib`: affected `>=0.1.0, <2.16.1`, fixed in `2.16.1` · CVSS 8.2 High · Not analysed yet · Published 13 May 2026 · Tags: CWE-409
- [Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy](https://agentprime.io/advisories/GHSA-jfc2-q6qh-g5x8.md)
  `GHSA-jfc2-q6qh-g5x8`, `CVE-2026-8466`, `EEF-CVE-2026-8466` · Hex `cowboy`: affected `>=2.0.0, <2.15.0`, fixed in `2.15.0` · CVSS 8.2 High · Not analysed yet · Published 13 May 2026 · Tags: Denial of service
- [HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit](https://agentprime.io/advisories/GHSA-rf5q-vwxw-gmrf.md)
  `GHSA-rf5q-vwxw-gmrf`, `CVE-2026-39806`, `EEF-CVE-2026-39806` · Hex `bandit`: affected `>=1.6.1, <1.11.1`, fixed in `1.11.1` · CVSS 8.7 High · Not analysed yet · Published 13 May 2026 · Tags: Denial of service
- [HTTP/1 chunked body reader ignores length cap in bandit](https://agentprime.io/advisories/GHSA-9q9q-324x-93r2.md)
  `GHSA-9q9q-324x-93r2`, `CVE-2026-39803`, `EEF-CVE-2026-39803` · Hex `bandit`: affected `>=1.4.0, <1.11.1`, fixed in `1.11.1` · CVSS 8.7 High · Not analysed yet · Published 13 May 2026 · Tags: Denial of service
- [SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3](https://agentprime.io/advisories/GHSA-r73h-97w8-m54h.md)
  `GHSA-r73h-97w8-m54h`, `CVE-2026-32687`, `EEF-CVE-2026-32687` · Hex `postgrex`: affected `>=0.16.0, <0.22.2`, fixed in `0.22.2` · CVSS 7.5 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1](https://agentprime.io/advisories/GHSA-hv23-4qp7-8c8r.md)
  `GHSA-hv23-4qp7-8c8r`, `CVE-2026-43968`, `EEF-CVE-2026-43968` · Hex `cowlib`: affected `>=2.6.0, <2.16.1`, fixed in `2.16.1` · CVSS 6.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: Other injection
- [Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS](https://agentprime.io/advisories/GHSA-32p9-57cr-4x65.md)
  `GHSA-32p9-57cr-4x65`, `CVE-2026-7790`, `EEF-CVE-2026-7790` · Hex `cowlib`: affected `>=0.6.0, <2.16.1`, fixed in `2.16.1` · CVSS 8.7 High · Not analysed yet · Published 11 May 2026 · Tags: Denial of service
- [Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1](https://agentprime.io/advisories/GHSA-g2wm-735q-3f56.md)
  `GHSA-g2wm-735q-3f56`, `CVE-2026-43969`, `EEF-CVE-2026-43969` · Hex `cowlib`: affected `>=2.9.0, <2.21.0`, fixed in `2.21.0` · CVSS 2.1 Low · Not analysed yet · Published 11 May 2026 · Tags: Other injection
- [ex_webrtc client-role handshake is missing DTLS peer fingerprint validation](https://agentprime.io/advisories/GHSA-qwfw-ggxw-577c.md)
  `GHSA-qwfw-ggxw-577c`, `CVE-2026-44700` · Hex `ex_webrtc`: affected `<0.15.1 || >=0.16.0, <0.16.1`, fixed in `0.15.1`, `0.16.1` · CVSS 8.7 High · Not analysed yet · Published 8 May 2026 · Tags: Weak cryptography or TLS
- [Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe](https://agentprime.io/advisories/GHSA-qf4g-9fqq-mmm7.md)
  `GHSA-qf4g-9fqq-mmm7`, `CVE-2026-42793`, `EEF-CVE-2026-42793` · Hex `absinthe`: affected `>=1.5.0, <1.10.2`, fixed in `1.10.2` · CVSS 8.2 High · Not analysed yet · Published 8 May 2026 · Tags: Denial of service
- [Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug](https://agentprime.io/advisories/GHSA-c62g-j346-39v5.md)
  `GHSA-c62g-j346-39v5`, `CVE-2026-42794`, `EEF-CVE-2026-42794` · Hex `absinthe_plug`: affected `>=1.2.0, <1.5.10`, fixed in `1.5.10` · CVSS 2.3 Low · Not analysed yet · Published 8 May 2026 · Tags: Cross-site scripting (XSS)
- [Quadratic fragment-name uniqueness check causes denial of service in absinthe](https://agentprime.io/advisories/GHSA-9mhv-8h52-q7q2.md)
  `GHSA-9mhv-8h52-q7q2`, `CVE-2026-43967`, `EEF-CVE-2026-43967` · Hex `absinthe`: affected `>=1.2.0, <1.10.2`, fixed in `1.10.2` · CVSS 8.7 High · Not analysed yet · Published 8 May 2026 · Tags: Denial of service
- [Unbounded exponent in decimal enables unauthenticated DoS](https://agentprime.io/advisories/GHSA-rhv4-8758-jx7v.md)
  `GHSA-rhv4-8758-jx7v`, `CVE-2026-32686`, `EEF-CVE-2026-32686` · Hex `decimal`: affected `>=0.1.0, <3.0.0`, fixed in `3.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 7 May 2026 · Tags: Denial of service
- [Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix](https://agentprime.io/advisories/GHSA-628h-q48j-jr6q.md)
  `GHSA-628h-q48j-jr6q`, `CVE-2026-32689`, `EEF-CVE-2026-32689` · Hex `phoenix`: affected `>=1.7.0, <1.7.22 || >=1.8.0, <1.8.6`, fixed in `1.7.22`, `1.8.6` · CVSS 8.7 High · Not analysed yet · Published 5 May 2026 · Tags: Denial of service
- [CL.CL HTTP request smuggling via duplicate Content-Length in bandit](https://agentprime.io/advisories/GHSA-c67r-gc9j-2qf7.md)
  `GHSA-c67r-gc9j-2qf7`, `CVE-2026-39805`, `EEF-CVE-2026-39805` · Hex `bandit`: affected `>=0.1.0, <1.11.0`, fixed in `1.11.0` · CVSS 6.3 Medium · Not analysed yet · Published 1 May 2026 · Tags: HTTP request smuggling
- [WebSocket permessage-deflate inflate has no output-size cap in bandit](https://agentprime.io/advisories/GHSA-frh3-6pv6-rc8j.md)
  `GHSA-frh3-6pv6-rc8j`, `CVE-2026-39804`, `EEF-CVE-2026-39804` · Hex `bandit`: affected `>=0.5.9, <1.11.0`, fixed in `1.11.0` · CVSS 8.2 High · Not analysed yet · Published 1 May 2026 · Tags: Denial of service
- [Client-supplied URI scheme trusted without transport verification in bandit](https://agentprime.io/advisories/GHSA-375f-4r2h-f99j.md)
  `GHSA-375f-4r2h-f99j`, `CVE-2026-39807`, `EEF-CVE-2026-39807` · Hex `bandit`: affected `>=1.0.0, <1.11.0`, fixed in `1.11.0` · CVSS 6.3 Medium · Not analysed yet · Published 1 May 2026 · Tags: CWE-807
- [WebSocket fragmented message reassembly unbounded in bandit](https://agentprime.io/advisories/GHSA-pf94-94m9-536p.md)
  `GHSA-pf94-94m9-536p`, `CVE-2026-42786`, `EEF-CVE-2026-42786` · Hex `bandit`: affected `>=0.5.0, <1.11.0`, fixed in `1.11.0` · CVSS 8.7 High · Not analysed yet · Published 1 May 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/ecosystem/hex.md>
Older: <https://agentprime.io/advisories/ecosystem/hex.md?cursor=WyIyMDI2LTA1LTAxVDIwOjM0OjE3LjAxNDAwMFoiLCJHSFNBLXBmOTQtOTRtOS01MzZwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Hex&cursor=WyIyMDI2LTA2LTI5VDE5OjEwOjQ5Ljg0MTAwMFoiLCJHSFNBLTQzODMtN3hmcC1ncHBoIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/hex/?cursor=WyIyMDI2LTA2LTI5VDE5OjEwOjQ5Ljg0MTAwMFoiLCJHSFNBLTQzODMtN3hmcC1ncHBoIl0>. Everything for agents: <https://agentprime.io/llms.txt>.