erlang/rebar3

erlang/rebar3

Releases82

Frequency1 month 2 weeks

Last Release 4 months ago

Stars1.81K

Erlang build tool that makes it easy to compile and test Erlang applications and releases.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-21619 ↗	Feb 27, 2026Friday, 27 February 2026, 18:16	7.5 HIGH	—
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
CVE-2019-1000014 ↗	Feb 4, 2019Monday, 4 February 2019, 21:29	—	6.8 MEDIUM
Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0.