hex_core 0.20.0 Restores TLS Certificate Validation
Tech GuruQuick Answer
hexpm published GHSA-p26c-h8c2-rwqj for hex_core's default HTTP adapter on specific OTP 24 and 25 paths. Upgrade to 0.20.0, or use the authority's explicit SSL, alternative-adapter, or OTP 26+ workaround, then validate certificate rejection and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory applications embedding hex_core, the configured HTTP adapter, Erlang/OTP release, CA-store availability, repository and API endpoints, and transmitted credentials; deploy hex_core 0.20.0 or an authority-supported workaround and verify that invalid or self-signed certificates are rejected.
Last verified: 2026-10-12 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | hex_core default hex_http_httpc adapter |
|---|---|
| Advisory | GHSA-p26c-h8c2-rwqj / CVE-2026-103502 |
| CVE | CVE-2026-103502 |
| Authoritative release date | 2026-10-12 15:33:48 UTC |
| Authority revision date | 2026-10-12 15:33:49 UTC |
| Affected versions | hex_core before 0.20.0 when the default adapter runs on OTP 24, or OTP 25 when system CA certificates cannot be loaded; versions before 0.11.0 are affected on OTP 25 and earlier regardless of CA-store availability. |
| Fixed version | hex_core 0.20.0; supported workarounds include explicit certificate-verifying SSL options, another HTTP adapter, or OTP 26 or later |
| CVSS base score | 5.9 (CVSS v4.0, EEF CNA record) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The default adapter could fall back to pre-OTP-26 TLS defaults that do not verify server certificates, allowing an on-path attacker to impersonate repositories or APIs and read or alter credentials and traffic.
What To Validate Now
- Inventory. Locate hex_core default hex_http_httpc adapter deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: hex_core before 0.20.0 when the default adapter runs on OTP 24, or OTP 25 when system CA certificates cannot be loaded; versions before 0.11.0 are affected on OTP 25 and earlier regardless of CA-store availability. Do not infer applicability from product family or severity alone.
- Remediate. Apply hex_core 0.20.0; supported workarounds include explicit certificate-verifying SSL options, another HTTP adapter, or OTP 26 or later through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Hex and rebar3 vendor hex_core but configure their own adapters and are not affected according to the advisory. Registry signatures do not protect API credentials or arbitrary responses; test outbound TLS and credential handling separately. Preserve the authority snapshot, asset and owner records, before-and-after versions, change approval, installation output, validation results, exceptions, and rollback evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
