PT-2026-53681 · Leandrocp · Mdex+1
Leandro Pereira
+1
·
Published
2026-06-29
·
Updated
2026-06-29
·
CVE-2026-53428
CVSS v4.0
6.9
Medium
| Vector | AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Memory Allocation with Excessive Size Value vulnerability in leandrocp mdex allows an unauthenticated attacker to cause a denial of service through unbounded memory allocation.
comrak nif::lumis adapter::LumisAdapter::parse highlight lines in native/comrak nif/src/lumis adapter.rs eagerly expands a user-controlled inclusive line range from a fenced code block's highlight lines decorator into a Vec, pushing one element per integer in the range with no upper bound on the range size. An attacker who can supply Markdown that an application renders with MDEx.to html/2 (for example a comment, chat message, or wiki page) can embed a code block whose info string is rust highlight lines="1-100000000", forcing the native adapter to allocate roughly 8 bytes per line in the range.
A payload that differs by only a few bytes can therefore allocate hundreds of megabytes, and a sufficiently large range (for example 1-2000000000) exhausts host memory and aborts the BEAM, denying service to every user of the rendering process. The per-line write loop additionally tests membership with a linear scan over the same vector, degrading rendering to a quadratic cost even for ranges that do not immediately exhaust memory.
The vulnerable native code originally shipped inside mdex (in native/comrak nif/src/lumis adapter.rs) and was later extracted into the separate mdex native package (native/mdex native nif/src/lumis adapter.rs), where it remains unpatched.
This issue affects mdex from 0.11.0 before 0.12.3, and mdex native from 0.1.0 before 0.2.3.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mdex
Mdex Native