Read the docs
TI-2026-38508 Aliases CVE-2026-53426

Atom-table exhaustion denial-of-service via JSON parse_document in MDEx

Priority LOW 35CWE-770Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.parse_document/2 accepts a {:json, json} source. In lib/mdex.ex, the private json_to_node/1 function passes the attacker-controlled node_type value to Module.concat/1, which calls String.to_atom/1 and interns a brand-new atom for every distinct value. Atoms are never garbage collected on the BEAM, so a crafted JSON document carrying a unique node_type at each (deeply nested) node mints one permanent atom per node. A single document can intern hundreds of thousands of atoms, and a large enough document exhausts the default atom table (around 1,048,576 atoms) and aborts the entire Erlang VM, taking down every process on the node. Any application that passes untrusted input to the {:json, ...} source of MDEx.parse_document is exposed to an unauthenticated denial-of-service. This issue affects mdex from 0.4.3 before 0.13.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0018 7th percentileScored 2026-11-07
Fix Fixed mdex (leandrocp): 0.13.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
leandrocpmdex0.4.3 to before 0.13.20.13.2Patch availableCNA
  • mdex Vendorleandrocp Affected 0.4.3 to before 0.13.2 Fixed in 0.13.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*——leandrocp
  • cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:* Versions — — ·leandrocp

Remediation

  • Fix · CNA mdex (leandrocp) Fixed in 0.13.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    leandrocp mdex 0.13.2

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-39662 Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)Priority MEDIUM 56
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53426

References

Patch 1

Advisory 1

Other 2

  • TI-2026-39661 Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex CVSS 4.0MEDIUM 6.9
  • TI-2026-38511 Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service CVSS 4.0MEDIUM 6.9
  • TI-2026-39662 Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS) CVSS 4.0MEDIUM 5.1
  • TI-2026-38510 Unbounded memory allocation in highlight_lines range expansion in mdex CVSS 4.0MEDIUM 6.9
  • TI-2026-38509 Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences