Uncontrolled Recursion Vulnerability in MDEx by leandrocp

CVE-2026-54888

What is CVE-2026-54888?

The MDEx library is impacted by an uncontrolled recursion vulnerability that allows attackers to exploit deeply nested Markdown input, resulting in a denial of service. The underlying issue arises from the absence of a maximum nesting depth in the Rust functions processing the Markdown, leading to unbounded recursion. When an attacker crafts a Markdown document with extensive nesting of block quotes, it results in a stack overflow that cannot be handled by the Erlang runtime, causing the termination of the BEAM process and affecting all Elixir and Erlang processes on the node. This vulnerability is not limited by authentication or user privileges, making it a significant risk for all users of the affected versions.

References