CVE-2026-105668

A flaw was found in hex. This vulnerability allows an attacker with package owner privileges to bypass release-age cooldown security controls when publishing a new package release. By retiring an existing package release, the attacker triggers an automatic cooldown bypass, causing downstream dependency updates to immediately pull the newly published release without observing the required waiting period. Consequently, this flaw can enable the rapid deployment of unvetted or malicious dependencies into downstream environments.

A flaw of moderate impact was found in hex, the package manager for the Elixir/Erlang ecosystem, which Red Hat tracks only in its community Fedora and EPEL streams. Hex's release-age cooldown (the cooldown config option or HEX_COOLDOWN environment variable) withholds versions younger than the configured age during dependency resolution so that newly published, potentially malicious releases are not pulled into projects immediately. When the release of a package locked in mix.lock is retired or carries a security advisory, Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypass/1 lift the cooldown for every version of that package and of every package the locked release depends on. Because retiring a release requires the same package owner permission as publishing one, an attacker who controls or has compromised a package owner account can publish a malicious release, retire the currently locked release, and have the next mix deps.update that unlocks the package select the new release regardless of its age, enabling the rapid deployment of unvetted or malicious dependency code into downstream environments. The bypass check in Hex.Registry.Cooldown.versions/2 matches by package name alone, so it also covers packages with the same name in other repositories; cooldowns enforced through an organization dependency policy are not affected. Exploitation requires high privileges (package owner) and user interaction (a victim running a dependency update), which is why Red Hat rates this flaw Moderate with a CVSS 3.1 score of 6.8, while the upstream CVEORG record scores it Important at CVSS 4.0 score 7.1; the difference stems from CVSS version and metric differences (attack complexity and user interaction) rather than a substantive disagreement about impact. No Red Hat-shipped products are affected; the tracked Fedora and EPEL community entries are affected with delegated resolution, meaning a fix is being pursued through the community maintainers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.