https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 13:18:44 +0000 https://db.gcve.eu/vuln/cve-2026-103502 <p><strong>Affected:</strong> hexpm hex_core</p> <p>Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core&#39;s default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating system&#39;s CA certificates can&#39;t be loaded.</p> <p>hex_core:default_config/0 selects the built-in hex_http_httpc adapter. For an HTTPS request whose adapter config has no ssl option, hex_http_httpc:http_options/2 builds options that verify the server certificate against public_key:cacerts_get/0. When that call raises, the adapter prints a warning and sends the request without ssl options, so httpc uses the defaults of the ssl application, which before OTP 26 don&#39;t verify the server certificate. public_key:cacerts_get/0 doesn&#39;t exist on OTP 24, so every HTTPS request falls back there, and on OTP 25 it raises when no CA store is found. hex_core versions before 0.11.0 never set ssl options, so they don&#39;t verify the server certificate on OTP 25 and earlier whether or not a CA store is found.</p> <p>The fallback was intended and documented, but the documentation didn&#39;t make clear that it meant no certificate verification. Since hex_core 0.8.2 the README has warned that the built-in httpc adapter &#34;has insecure default settings&#34; and recommended other HTTP clients, and the adapter prints &#34;using default ssl options which are insecure&#34; on every request that falls back. hex_core 0.11.0 added certificate verifi…</p> <p><strong>Affected:</strong> hexpm hex_core</p> <p>Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core&#39;s default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating system&#39;s CA certificates can&#39;t be loaded.</p> <p>hex_core:default_config/0 selects the built-in hex_http_httpc adapter. For an HTTPS request whose adapter config has no ssl option, hex_http_httpc:http_options/2 builds options that verify the server certificate against public_key:cacerts_get/0. When that call raises, the adapter prints a warning and sends the request without ssl options, so httpc uses the defaults of the ssl application, which before OTP 26 don&#39;t verify the server certificate. public_key:cacerts_get/0 doesn&#39;t exist on OTP 24, so every HTTPS request falls back there, and on OTP 25 it raises when no CA store is found. hex_core versions before 0.11.0 never set ssl options, so they don&#39;t verify the server certificate on OTP 25 and earlier whether or not a CA store is found.</p> <p>The fallback was intended and documented, but the documentation didn&#39;t make clear that it meant no certificate verification. Since hex_core 0.8.2 the README has warned that the built-in httpc adapter &#34;has insecure default settings&#34; and recommended other HTTP clients, and the adapter prints &#34;using default ssl options which are insecure&#34; on every request that falls back. hex_core 0.11.0 added certificate verifi…</p> https://db.gcve.eu/vuln/cve-2026-103502