https://seclists.org/oss-sec/2026/q4/152: Hex 2.5.2 leased with security fixes
Published Oct 14, 2026
·Updated
Affected Software
1 affected component
Hex Hex=2.5.2
Frequently Asked Questions
1
When was a custom CA bundle restriction ineffective?
When cacerts_path or HEX_CACERTS_PATH was set, Hex still accepted server certificate chains leading to a CA in its bundled store. This meant bundled CAs could still authenticate Hex servers despite the custom CA configuration.
2
What certificate-validation behavior was corrected?
Hex previously trusted CA certificate copies supplied by the server when they had the same public key as a CA in the configured CA store. A server could use this to provide a copy of an expired CA certificate with a later expiration date.
3
What input could cause documentation files to be written outside the intended directory?
A version string such as 1.0.0/../../x, supplied on the command line or in mix.lock, could cause mix hex.docs fetch to write outside the docs directory.