CVE-2026-53426

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53426
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53426.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53426
Aliases
Published
2026-06-29T19:11:32.605Z
Modified
2026-07-15T01:49:19.152610688Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator
Summary
Atom-table exhaustion denial-of-service via JSON parse_document in MDEx
Details

Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation.

MDEx.parsedocument/2 accepts a {:json, json} source. In lib/mdex.ex, the private jsontonode/1 function passes the attacker-controlled nodetype value to Module.concat/1, which calls String.toatom/1 and interns a brand-new atom for every distinct value. Atoms are never garbage collected on the BEAM, so a crafted JSON document carrying a unique nodetype at each (deeply nested) node mints one permanent atom per node.

A single document can intern hundreds of thousands of atoms, and a large enough document exhausts the default atom table (around 1,048,576 atoms) and aborts the entire Erlang VM, taking down every process on the node. Any application that passes untrusted input to the {:json, ...} source of MDEx.parse_document is exposed to an unauthenticated denial-of-service.

This issue affects mdex from 0.4.3 before 0.13.2.

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53426.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "cbb59a3f792dbc343873adec3466f49c853dc309"
                },
                {
                    "fixed": "00fddf444220a1f1cc0af0a1cab6738804878387"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "EEF"
}
References

Affected packages

Git / github.com/leandrocp/mdex

Affected ranges

Type
GIT
Repo
https://github.com/leandrocp/mdex
Events
Introduced
4781d9a115108092a97b2099e5578b0f1499f526
Fixed
c05684d9e78fc879d71ad39f2f5827b124cb5881
Fixed
00fddf444220a1f1cc0af0a1cab6738804878387
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.4.3"
        },
        {
            "fixed": "0.13.2"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.10.0
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.11.4
v0.11.5
v0.11.6
v0.11.7
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.12.4
v0.12.5
v0.13.0
v0.13.1
v0.4.3
v0.5.0
v0.6.0
v0.6.1
v0.6.2
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53426.json"