# CVE-2026-53428: leandrocp mdex denial of service via unbounded memory allocation

Source: https://junglewise.ai/threats/cve-2026-53428-leandrocp-mdex-denial-of-service-via-unbounded-memory-allocation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-53428 · Severity: info · CVSS 6.9 · Published 2026-06-29

A vulnerability in the mdex Markdown rendering library can allow an attacker to crash a server by providing a specially crafted document. By specifying an extremely large range of lines to highlight in a code block, an attacker can force the system to exhaust all available memory. This results in a denial of service, making the application or service unavailable to all users.

Technologies: [Leandrocp Mdex](https://junglewise.ai/threats/technologies/mdex), [Leandrocp Mdex Native](https://junglewise.ai/threats/technologies/mdex-native). Vendors: [Leandrocp](https://junglewise.ai/threats/vendors/leandrocp).

## Quick answers

**Is CVE-2026-53428 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53428 being exploited in the wild.

**How severe is CVE-2026-53428?** Informational severity, with a CVSS score of 6.9, published 29 June 2026.

**Which products and versions are affected?** Leandrocp Mdex >= 0.11.0, < 0.12.3; Leandrocp Mdex Native >= 0.1.0, < 0.2.3.

**Is there a fix for CVE-2026-53428?** A patch was published on 2026-06-29: Fixed in mdex 0.12.3 and mdex_native 0.2.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53428 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53428?** Check whether you run Leandrocp Mdex or Leandrocp Mdex Native at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `parse_highlight_lines` routine within `lumis_adapter.rs`. The code eagerly expands user-controlled inclusive line ranges (e.g., '1-100000000') into a `Vec<usize>` without upper-bound validation. This results in approximately 8 bytes of allocation per integer in the range. An attacker can provide a large range in a Markdown fenced code block's `highlight_lines` decorator to exhaust host memory and abort the BEAM process. Exploitation requires `github_pre_lang` and `full_info_string` options to be enabled alongside an inline syntax-highlight formatter. The issue was fixed in mdex 0.12.3 and mdex_native 0.2.3.

## Affected products

- leandrocp mdex >= 0.11.0, < 0.12.3
- leandrocp mdex_native >= 0.1.0, < 0.2.3

## Timeline

- 2026-06-29: disclosed
- 2026-06-29: patched: Fixed in mdex 0.12.3 and mdex_native 0.2.3
- 2026-06-29: advisory

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-53428.html](https://cna.erlef.org/cves/CVE-2026-53428.html)
- [https://github.com/leandrocp/mdex_native/commit/798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3](https://github.com/leandrocp/mdex_native/commit/798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3)
- [https://github.com/leandrocp/mdex_native/security/advisories/GHSA-j93q-9cvj-rxfm](https://github.com/leandrocp/mdex_native/security/advisories/GHSA-j93q-9cvj-rxfm)

## Related threats

- [leandrocp mdex uncontrolled recursion in Markdown parsing](https://junglewise.ai/threats/cve-2026-54888-leandrocp-mdex-uncontrolled-recursion-in-markdown-parsing)