Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-674.
Summary
Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of service via deeply nested Markdown input. mdex converts between an Elixir %MDEx.Document{} struct and Comrak's internal AST using two mutually recursive Rust functions, ex_document_to_comrak_ast and comrak_ast_to_ex_document, in the NIF source file document.rs. Neither function enforces a maximum nesting depth, so the recursion depth is bounded only by the structure of the input. An attacker who can get a Markdown document rendered (for example through MDEx.parse_document!/1 or MDEx.to_html/1) can supply a document with thousands of nested block quotes, which drives unbounded recursion across the NIF boundary and exhausts the native C stack. Because the resulting stack overflow is an uncatchable SIGSEGV raised inside a NIF, it cannot be contained by the Erlang runtime. It terminates the operating system process running the BEAM, killing every Elixir and Erlang process on the node, not just the caller that triggered the render. No authentication or special privileges are required. The vulnerable conversion code was extracted from mdex into the separate mdex_native package starting in mdex 0.12.3. This issue affects mdex from 0.3.0 before 0.12.3 and mdex_native from 0.1.0 before 0.2.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA mdex (leandrocp) Fixed in 0.12.3
- Fix · CNA mdex_native (leandrocp) Fixed in 0.2.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
leandrocp mdex, mdex_native 0.12.3, 0.2.3, 6ed94d905f97af188323f042698ae841c02293b4
4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-38511 Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of servicePriority MEDIUM 64
- TI-2026-38510 Unbounded memory allocation in highlight_lines range expansion in mdexPriority LOW 30
- TI-2026-38509 Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attributePriority LOW 13
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54888
References
More leandrocp vulnerabilities
- TI-2026-38511 Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service CVSS 4.0MEDIUM 6.9
- TI-2026-39662 Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS) CVSS 4.0MEDIUM 5.1
- TI-2026-38508 Atom-table exhaustion denial-of-service via JSON parse_document in MDEx CVSS 4.0HIGH 8.2
- TI-2026-38510 Unbounded memory allocation in highlight_lines range expansion in mdex CVSS 4.0MEDIUM 6.9
- TI-2026-38509 Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute CVSS 4.0LOW 2.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences