Executive brief
A vulnerability in the mdex Markdown rendering library can allow an attacker to crash a server by providing a specially crafted document. By specifying an extremely large range of lines to highlight in a code block, an attacker can force the system to exhaust all available memory. This results in a denial of service, making the application or service unavailable to all users.
Technical details
The vulnerability exists in the `parse_highlight_lines` routine within `lumis_adapter.rs`. The code eagerly expands user-controlled inclusive line ranges (e.g., '1-100000000') into a `Vec<usize>` without upper-bound validation. This results in approximately 8 bytes of allocation per integer in the range. An attacker can provide a large range in a Markdown fenced code block's `highlight_lines` decorator to exhaust host memory and abort the BEAM process. Exploitation requires `github_pre_lang` and `full_info_string` options to be enabled alongside an inline syntax-highlight formatter. The issue was fixed in mdex 0.12.3 and mdex_native 0.2.3.
Affected products
- leandrocp mdex >= 0.11.0, < 0.12.3
- leandrocp mdex_native >= 0.1.0, < 0.2.3
Timeline
- 2026-06-29: disclosed
- 2026-06-29: patched: Fixed in mdex 0.12.3 and mdex_native 0.2.3
- 2026-06-29: advisory