{"affected":[{"package":{"ecosystem":"Hex","name":"mdex","purl":"pkg:hex/mdex"},"ranges":[{"events":[{"introduced":"0.11.0"},{"fixed":"0.12.3"}],"type":"SEMVER"}],"versions":["0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.11.5","0.11.6","0.11.7","0.12.0","0.12.1","0.12.2"]},{"package":{"ecosystem":"Hex","name":"mdex_native","purl":"pkg:hex/mdex_native"},"ranges":[{"events":[{"introduced":"0.1.0"},{"fixed":"0.2.3"}],"type":"SEMVER"}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.2.0","0.2.1","0.2.2"]},{"ranges":[{"events":[{"introduced":"a8407611715d1ead35fbcba79c72cef1b7df387b"},{"fixed":"6ed94d905f97af188323f042698ae841c02293b4"}],"repo":"https://github.com/leandrocp/mdex","type":"GIT"}]},{"ranges":[{"events":[{"introduced":"956528c5e31746253347029e810a969ab916fd27"},{"fixed":"798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3"}],"repo":"https://github.com/leandrocp/mdex_native","type":"GIT"}]}],"aliases":["GHSA-j93q-9cvj-rxfm","CVE-2026-53428"],"credits":[{"name":"Peter Ullrich","type":"FINDER"},{"name":"Leandro Pereira","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"ANALYST"}],"database_specific":{"capec_ids":["CAPEC-130"],"cpe_ids":["cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*","cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-789"]},"details":"## Summary\n\nMemory Allocation with Excessive Size Value vulnerability in leandrocp mdex allows an unauthenticated attacker to cause a denial of service through unbounded memory allocation.\n\ncomrak\\_nif::lumis\\_adapter::LumisAdapter::parse\\_highlight\\_lines in native/comrak\\_nif/src/lumis\\_adapter.rs eagerly expands a user-controlled inclusive line range from a fenced code block's highlight\\_lines decorator into a Vec<usize>, pushing one element per integer in the range with no upper bound on the range size. An attacker who can supply Markdown that an application renders with MDEx.to\\_html/2 (for example a comment, chat message, or wiki page) can embed a code block whose info string is rust highlight\\_lines=\"1-100000000\", forcing the native adapter to allocate roughly 8 bytes per line in the range.\n\nA payload that differs by only a few bytes can therefore allocate hundreds of megabytes, and a sufficiently large range (for example 1-2000000000) exhausts host memory and aborts the BEAM, denying service to every user of the rendering process. The per-line write loop additionally tests membership with a linear scan over the same vector, degrading rendering to a quadratic cost even for ranges that do not immediately exhaust memory.\n\nThe vulnerable native code originally shipped inside mdex (in native/comrak\\_nif/src/lumis\\_adapter.rs) and was later extracted into the separate mdex\\_native package (native/mdex\\_native\\_nif/src/lumis\\_adapter.rs), where it remains unpatched.\n\nThis issue affects mdex from 0.11.0 before 0.12.3, and mdex\\_native from 0.1.0 before 0.2.3.\n\n## Workaround\n\nDo not enable code-block decorators: leave the github\\_pre\\_lang and full\\_info\\_string render options unset, or avoid configuring an inline syntax-highlight formatter, so that highlight\\_lines specifications are never parsed.\n\n## Configuration\n\nExploitation requires the application to enable code-block decorators. Decorators are active only when the render options github\\_pre\\_lang and full\\_info\\_string are both set and an inline syntax-highlight formatter (for example {:html\\_inline, ...}) is configured. Applications that render Markdown with the default options do not parse highlight\\_lines specifications and are not affected.","id":"EEF-CVE-2026-53428","modified":"2026-06-29T18:52:36.199Z","published":"2026-06-29T18:52:36.199Z","references":[{"type":"ADVISORY","url":"https://github.com/leandrocp/mdex_native/security/advisories/GHSA-j93q-9cvj-rxfm"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-53428.html"},{"type":"FIX","url":"https://github.com/leandrocp/mdex_native/commit/798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3"},{"type":"PACKAGE","url":"https://hex.pm/packages/mdex"},{"type":"PACKAGE","url":"https://hex.pm/packages/mdex_native"}],"related":[],"schema_version":"1.7.3","severity":[{"score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","type":"CVSS_V4"}],"summary":"Unbounded memory allocation in highlight_lines range expansion in mdex","upstream":[]}