# CVE-2026-124683: Eclipse Langium algorithmic complexity DoS in IndentationAwareTokenBuilder

Source: https://junglewise.ai/threats/cve-2026-124683-eclipse-langium-versions-3-2-0-through-4-4-0-contain-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-124683 · Severity: info · Published 2026-11-09

Eclipse Langium is a language engineering framework used to create domain-specific languages. Versions 3.2.0 through 4.4.0 contain a performance vulnerability in the opt-in indentation-aware tokenizer that causes the Node.js event loop to block for extended periods when processing specially crafted documents. An attacker can supply a malicious document with frequent indentation changes to freeze the application for tens of seconds, denying service to all users on the same server process.

Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-124683 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124683 being exploited in the wild.

**How severe is CVE-2026-124683?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Eclipse Langium 3.2.0 through 4.4.0.

**Is there a fix for CVE-2026-124683?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-124683 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-124683?** Check whether you run Eclipse Langium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The IndentationAwareTokenBuilder and IndentationAwareLexer components recompute line numbers inefficiently by re-scanning the entire preceding document text for each DEDENT token, resulting in O(n²) complexity. A document with indentation changes on most lines triggers quadratic tokenization time. The synchronous tokenization blocks the Node.js event loop, enabling denial of service; only opt-in configurations are affected, as the default tokenizer is unaffected.

## Affected products

- Eclipse Langium 3.2.0 through 4.4.0

## Timeline

- 2026-11-09: disclosed

## References

- [https://github.com/eclipse-langium/langium/security/advisories/GHSA-297v-g8mm-qj4h](https://github.com/eclipse-langium/langium/security/advisories/GHSA-297v-g8mm-qj4h)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/553](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/553)

## Related threats

- [Eclipse Langium langium-sprotty XSS in diagnostic messages](https://junglewise.ai/threats/cve-2026-118492-in-eclipse-langium-versions-3-0-0-and-later-the-langium-sprotty)