erlang/rebar3

erlang/rebar3

Releases82

Frequency1 month 2 weeks

Last Release5 months ago

Stars1.81K

Erlang build tool that makes it easy to compile and test Erlang applications and releases.

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2026-21619NVD↗	>= 3.9.1, < 3.27.0	Feb 27, 2026Friday, 27 February 2026, 18:16	7.5 HIGH	—
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
CVE-2020-13802NVD↗	= 3.0.0, >= 3.1.0, <= 3.13.2	Sep 2, 2020Wednesday, 2 September 2020, 17:15	9.8 CRITICAL	10 HIGH
Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.
CVE-2019-1000014NVD↗	>= 3.7.0, <= 3.7.5	Feb 4, 2019Monday, 4 February 2019, 21:29	—	6.8 MEDIUM
Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0.