← Back to CVE Explorer

CVE-2026-53426

Full vulnerability record from the local CVENow database.

Description

Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.parse_document/2 accepts a {:json, json} source. In lib/mdex.ex, the private json_to_node/1 function passes the attacker-controlled node_type value to Module.concat/1, which calls String.to_atom/1 and interns a brand-new atom for every distinct value. Atoms are never garbage collected on the BEAM, so a crafted JSON document carrying a unique node_type at each (deeply nested) node mints one permanent atom per node. A single document can intern hundreds of thousands of atoms, and a large enough document exhausts the default atom table (around 1,048,576 atoms) and aborts the entire Erlang VM, taking down every process on the node. Any application that passes untrusted input to the {:json, ...} source of MDEx.parse_document is exposed to an unauthenticated denial-of-service. This issue affects mdex from 0.4.3 before 0.13.2.

Severity
HIGH
CVSS score
8.2 (v4.0)
Vulnerability status
Deferred
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-06-29 20:17:38.473000
Last modified
2026-10-25 21:10:00.770000
View original CVE JSON 
{
  "id": "CVE-2026-53426",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-06-29T20:17:38.473",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation.\n\nMDEx.parse_document/2 accepts a {:json, json} source. In lib/mdex.ex, the private json_to_node/1 function passes the attacker-controlled node_type value to Module.concat/1, which calls String.to_atom/1 and interns a brand-new atom for every distinct value. Atoms are never garbage collected on the BEAM, so a crafted JSON document carrying a unique node_type at each (deeply nested) node mints one permanent atom per node.\n\nA single document can intern hundreds of thousands of atoms, and a large enough document exhausts the default atom table (around 1,048,576 atoms) and aborts the entire Erlang VM, taking down every process on the node. Any application that passes untrusted input to the {:json, ...} source of MDEx.parse_document is exposed to an unauthenticated denial-of-service.\n\nThis issue affects mdex from 0.4.3 before 0.13.2."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Asignación de Recursos Sin Límites ni Limitación en leandrocp MDEx permite Asignación Excesiva.\n\nMDEx.parse_document/2 acepta una fuente {:json, json}. En lib/mdex.ex, la función privada json_to_node/1 pasa el valor node_type controlado por el atacante a Module.concat/1, que llama a String.to_atom/1 e interna un átomo completamente nuevo por cada valor distinto. Los átomos nunca se recolectan como basura en BEAM, por lo que un documento JSON manipulado que lleva un node_type único en cada nodo (profundamente anidado) crea un átomo permanente por nodo.\n\nUn solo documento puede internar cientos de miles de átomos, y un documento lo suficientemente grande agota la tabla de átomos predeterminada (alrededor de 1.048.576 átomos) y aborta toda la VM de Erlang, derribando cada proceso en el nodo. Cualquier aplicación que pase entrada no confiable a la fuente {:json, ...} de MDEx.parse_document está expuesta a una denegación de servicio no autenticada.\n\nEste problema afecta a mdex desde 0.4.3 antes de 0.13.2."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "leandrocp",
          "product": "mdex",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "mdex",
          "cpes": [
            "cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.MDEx'"
          ],
          "programFiles": [
            "lib/mdex.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.MDEx':parse_document/2"
            },
            {
              "name": "'Elixir.MDEx':json_to_node/1"
            }
          ],
          "repo": "https://github.com/leandrocp/mdex",
          "packageURL": "pkg:hex/mdex",
          "versions": [
            {
              "version": "0.4.3",
              "lessThan": "0.13.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "leandrocp",
          "product": "mdex",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "leandrocp/mdex",
          "cpes": [
            "cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.MDEx'"
          ],
          "programFiles": [
            "lib/mdex.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.MDEx':parse_document/2"
            },
            {
              "name": "'Elixir.MDEx':json_to_node/1"
            }
          ],
          "repo": "https://github.com/leandrocp/mdex",
          "packageURL": "pkg:github/leandrocp/mdex",
          "versions": [
            {
              "version": "cbb59a3f792dbc343873adec3466f49c853dc309",
              "lessThan": "00fddf444220a1f1cc0af0a1cab6738804878387",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "HIGH",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T20:49:38.921685Z",
          "id": "CVE-2026-53426",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-53426.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/leandrocp/mdex/commit/00fddf444220a1f1cc0af0a1cab6738804878387",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/leandrocp/mdex/security/advisories/GHSA-923r-7vf4-5vw8",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53426",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ]
}