Denial-of-Service Vulnerability in MDEx by Leandrocp

CVE-2026-53426

What is CVE-2026-53426?

The MDEx library by Leandrocp is susceptible to a vulnerability that allows excessive allocation of atoms when processing JSON documents. This occurs in the MDEx.parse_document function when it handles attacker-controlled inputs, specifically node_type values. Each unique value creates a new atom that remains in memory, leading to potential exhaustion of the atom table in the Erlang VM. A crafted JSON with numerous distinct node_type values can crash the entire VM, resulting in denial-of-service for applications relying on this library. It is essential for developers to ensure untrusted input is validated and controlled to mitigate this risk.

References