CVE-2026-96618

A flaw was found in hex. An untrusted package mirror can trigger a Denial of Service (DoS) by serving excessively large or highly compressed responses when fetching packages, documentation, or registry metadata. Because the client processes and decompresses incoming network data without enforcing size limits, processing these payloads can exhaust available system memory or disk space on the host machine.

This vulnerability is rated Moderate because exploitation requires explicitly configuring the client to retrieve packages or documentation from an untrusted mirror, and the resulting blast radius is confined to a local denial-of-service condition. Standard environments connecting directly to the default repository over HTTPS are not exposed. Exploitation can exhaust local memory or disk space during package resolution tasks, but it does not permit unauthorized code execution or compromise data confidentiality and integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.