Executive brief
A memory leak vulnerability exists in the mdex and mdex_native libraries, which are used to render Markdown documents in Elixir applications. By providing a specially crafted document, an attacker can cause the application to consume all available system memory. This leads to a denial of service, potentially crashing the entire server or application environment.
Technical details
A Missing Release of Memory after Effective Lifetime (CWE-401) exists in the Rust NIF component of mdex and mdex_native. The vulnerability is located in the conversion of %MDEx.EscapedTag{} nodes into their native representation within document.rs, where the code calls Box::leak on caller-supplied literal strings. Because the byte length and frequency of these nodes are attacker-controlled and lack size limits or string interning, repeated rendering of malicious documents results in a permanent native memory leak. This eventually exhausts the memory of the BEAM process, leading to a crash. The issue is fixed in mdex 0.12.3 and mdex_native 0.2.3.
Affected products
- leandrocp mdex >= 0.11.0, < 0.12.3
- leandrocp mdex_native >= 0.1.0, < 0.2.3
Timeline
- 2026-06-29: advisory: GHSA-cmvp-gp9f-23xw published
- 2026-06-29: disclosed: CVE-2026-53429 published