CVE-2026-54888

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54888
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54888.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54888
Aliases
Published
2026-06-29T19:10:38.151Z
Modified
2026-07-15T01:48:56.713398283Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex
Details

Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of service via deeply nested Markdown input.

mdex converts between an Elixir %MDEx.Document{} struct and Comrak's internal AST using two mutually recursive Rust functions, exdocumenttocomrakast and comrakasttoexdocument, in the NIF source file document.rs. Neither function enforces a maximum nesting depth, so the recursion depth is bounded only by the structure of the input. An attacker who can get a Markdown document rendered (for example through MDEx.parsedocument!/1 or MDEx.tohtml/1) can supply a document with thousands of nested block quotes, which drives unbounded recursion across the NIF boundary and exhausts the native C stack.

Because the resulting stack overflow is an uncatchable SIGSEGV raised inside a NIF, it cannot be contained by the Erlang runtime. It terminates the operating system process running the BEAM, killing every Elixir and Erlang process on the node, not just the caller that triggered the render. No authentication or special privileges are required.

The vulnerable conversion code was extracted from mdex into the separate mdexnative package starting in mdex 0.12.3. This issue affects mdex from 0.3.0 before 0.12.3 and mdexnative from 0.1.0 before 0.2.3.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54888.json",
    "cwe_ids": [
        "CWE-674"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "d0bc7d55177727c61d188ef465178ab3b81f4f2c"
                },
                {
                    "fixed": "6ed94d905f97af188323f042698ae841c02293b4"
                },
                {
                    "introduced": "956528c5e31746253347029e810a969ab916fd27"
                },
                {
                    "fixed": "947696c47bc22bea5dffc0f78c946fa6b70ce183"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "EEF"
}
References

Affected packages

Git / github.com/leandrocp/mdex

Affected ranges

Type
GIT
Repo
https://github.com/leandrocp/mdex
Events
Introduced
dd934e63b3f0fd4a02de343cda360def29175cf1
Fixed
2cb9eb2f6014414b40c8f1e5d5181b9692626c38
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.3.0"
        },
        {
            "fixed": "0.12.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}
Type
GIT
Repo
https://github.com/leandrocp/mdex_native
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b6caf84e9dd035654ed7e8955086ab37afdaa7a0
Fixed
947696c47bc22bea5dffc0f78c946fa6b70ce183
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "fixed": "0.2.3"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.10.0
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.11.4
v0.11.5
v0.11.6
v0.11.7
v0.12.0
v0.12.1
v0.12.2
v0.2.0
v0.2.1
v0.2.2
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.6.0
v0.6.1
v0.6.2
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54888.json"