CVE-2026-103503: Hex trusts its bundled CA certificates when cacerts_path is set
Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacertspath to a CA store that leaves that CA out.
cacertspath (HEXCACERTSPATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.sslopts/1 passes the configured store as the cacerts option, but builds the partialchain callback from the bundled store whether cacertspath is set or not. Hex.HTTP.SSL.partialchain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies.
This issue affects hex: from 0.20.2 before 2.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hexpm/hexto a version that resolves this vulnerability.Fixed in 2.5.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Hex versions from 0.20.2 before 2.5.2 are affected when cacerts_path or HEX_CACERTS_PATH is set to use a custom CA store. The described issue does not apply solely from using the CA bundle that ships with Hex.
What must an attacker be able to do to exploit this?
An attacker must be able to intercept the victim's HTTPS connection and possess a certificate for the targeted Hex host issued by a CA present in Hex's bundled CA store. Hostname verification still applies, so the certificate must match the host being impersonated.
Why does a custom CA store not provide the expected restriction?
Although Hex uses the configured CA store for its cacerts option, it constructs the partial-chain validation callback from the bundled CA store. A server chain can therefore be accepted if a certificate in the chain has the same public key as a bundled CA certificate, even when that CA is absent from the configured store.
What version should be used to remediate the issue?
Upgrade Hex to version 2.5.2 or later. The affected range is from 0.20.2 before 2.5.2.