CVE-2026-53426 Details
Description
Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.parse_document/2 accepts a {:json, json} source. In lib/mdex.ex, the private json_to_node/1 function passes the attacker-controlled node_type value to Module.concat/1, which calls String.to_atom/1 and interns a brand-new atom for every distinct value. Atoms are never garbage collected on the BEAM, so a crafted JSON document carrying a unique node_type at each (deeply nested) node mints one permanent atom per node. A single document can intern hundreds of thousands of atoms, and a large enough document exhausts the default atom table (around 1,048,576 atoms) and aborts the entire Erlang VM, taking down every process on the node. Any application that passes untrusted input to the {:json, ...} source of MDEx.parse_document is exposed to an unauthenticated denial-of-service. This issue affects mdex from 0.4.3 before 0.13.2.
A denial-of-service vulnerability has been identified in the MDEx library, versions 0.4.3 prior to 0.13.2. This issue arises from the 'parse_document/2' function, which accepts a 'json' source. The function processes the 'node_type' value from the JSON, converting it into an atom that is permanently stored. Since atoms are not garbage collected in the BEAM environment, a crafted JSON document can create a large number of these permanent atoms. This accumulation can exhaust the atom table, leading to a crash of the entire Erlang VM and disrupting all processes on the node. The vulnerability is exploitable by any application that inputs untrusted JSON into the 'parse_document' function.
Users are advised not to pass untrusted or attacker-controlled input to the 'MDEx.parse_document/2' function when using the 'json' source. The 'markdown' source is not affected.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-53426.html | EEF | AdvisoryRemedy |
| https://github.com/leandrocp/mdex/commit/00fddf444220a1f1cc0af0a1cab6738804878387 | EEF | Source CodeVendor |
| https://github.com/leandrocp/mdex/security/advisories/GHSA-923r-7vf4-5vw8 | EEF | AdvisoryVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-53426 | EEF | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | EEF |
Affected Products
| Product | Versions |
|---|---|
| leandrocp MDEx | >= 0.4.3, < 0.13.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | EEF |