Hex Package Vulnerabilities
Vulnerabilities associated with phoenix.
Packages
Clear package- hackney12 vulnerabilities
- bandit7 vulnerabilities
- tesla5 vulnerabilities
- ash4 vulnerabilities
- cowlib4 vulnerabilities
- gun4 vulnerabilities
- mint4 vulnerabilities
- plug4 vulnerabilities
- rabbit_common4 vulnerabilities
- ewe3 vulnerabilities
- phoenix3 vulnerabilities
- phoenix_storybook3 vulnerabilities
- absinthe2 vulnerabilities
- ash_authentication2 vulnerabilities
- cowboy2 vulnerabilities
- hex_core2 vulnerabilities
- oban_web2 vulnerabilities
- phoenix_html2 vulnerabilities
- pow2 vulnerabilities
- req2 vulnerabilities
- wisp2 vulnerabilities
- MongooseIM1 vulnerability
- RabbitMQ1 vulnerability
- Samly1 vulnerability
- absinthe_plug1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-32689HIGH | Long-poll NDJSON body splitting causes unbounded memory allocation in PhoenixAllocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix allows a denial of service via the long-poll transport's NDJSON body handling. In 'Elixir.Phoenix.Transports.LongPoll':publish/4, when a POST request is received with Content-Type: application/x-ndjson, the request body is split on newline characters using String.split/2 with no limit on the number of resulting segments. An attacker can send a body consisting entirely of newline bytes, causing a 1:1 a… CWE-770May 5, 2026 | CVSS8.7v4.0 | EPSS0.469% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-42975HIGH | Phoenix before 1.6.14 mishandles check_origin wildcardingsocket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token. | CVSS7.5v3.1 | EPSS0.534% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-1000163MEDIUM | Phoenix Arbitrary URL RedirectThe Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks. | CVSS6.1v3.0 | EPSS2.38% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |