TI-2026-38604 Aliases CVE-2026-53531 GHSA-4w5h-hx6r-28q7

ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)

HIGH 70CWE-400Published 2026-08-21 · Updated 2026-08-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00426 37th percentileScored 2026-11-07

Fix Fixed RaTeX (erweixin): 0.1.11ratex-parser (crates.io): 0.1.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
erweixin	RaTeX	before 0.1.11	0.1.11	Patch available	CNA
—	ratex-parser (crates.io)	before 0.1.11	0.1.11	Patch available	GHSA-4w5h-hx6r-28q7

RaTeX Vendorerweixin Affected before 0.1.11 Fixed in 0.1.11 Patch available CNA
ratex-parser (crates.io) Vendor— Affected before 0.1.11 Fixed in 0.1.11 Patch available GHSA-4w5h-hx6r-28q7

Remediation

Fix · CNA RaTeX (erweixin) Fixed in 0.1.11
Fix · GHSA-4w5h-hx6r-28q7 ratex-parser (crates.io) Fixed in 0.1.11 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-53531
2026-10-03 Alias added: GHSA-4w5h-hx6r-28q7

References

Other 2

TI-2026-38603 ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice) CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences