Inefficient Algorithmic Complexity in Eclipse Langium by Eclipse

CVE-2026-124683

What is CVE-2026-124683?

Eclipse Langium versions ranging from 3.2.0 to 4.4.0 are impacted by an inefficiency in the IndentationAwareTokenBuilder and IndentationAwareLexer components. Specifically, when generating DEDENT tokens, the lexer recalculates line numbers by re-evaluating the entire preceding document, leading to quadratic time complexity for tokenization. This flaw means that if a document has frequent indentation changes, it can severely delay processing, potentially freezing the Node.js event loop for extended periods. As a result, this can lead to a Denial of Service for any users sharing the affected process, particularly with documents of a few hundred kilobytes in size. Notably, the languages supported by the DefaultLexer and DefaultTokenBuilder are not impacted by this vulnerability.

References