# CVE-2026-53429: leandrocp mdex memory leak in escaped-tag rendering

Source: https://junglewise.ai/threats/cve-2026-53429-leandrocp-mdex-memory-leak-in-escaped-tag-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-53429 · Severity: info · CVSS 6.9 · Published 2026-06-29

A memory leak vulnerability exists in the mdex and mdex_native libraries, which are used to render Markdown documents in Elixir applications. By providing a specially crafted document, an attacker can cause the application to consume all available system memory. This leads to a denial of service, potentially crashing the entire server or application environment.

## Quick answers

**Is CVE-2026-53429 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53429 being exploited in the wild.

**How severe is CVE-2026-53429?** Informational severity, with a CVSS score of 6.9, published 29 June 2026.

**Which products and versions are affected?** leandrocp mdex >= 0.11.0, < 0.12.3; leandrocp mdex_native >= 0.1.0, < 0.2.3.

**Is there a fix for CVE-2026-53429?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53429 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-53429?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Missing Release of Memory after Effective Lifetime (CWE-401) exists in the Rust NIF component of mdex and mdex_native. The vulnerability is located in the conversion of %MDEx.EscapedTag{} nodes into their native representation within document.rs, where the code calls Box::leak on caller-supplied literal strings. Because the byte length and frequency of these nodes are attacker-controlled and lack size limits or string interning, repeated rendering of malicious documents results in a permanent native memory leak. This eventually exhausts the memory of the BEAM process, leading to a crash. The issue is fixed in mdex 0.12.3 and mdex_native 0.2.3.

## Affected products

- leandrocp mdex >= 0.11.0, < 0.12.3
- leandrocp mdex_native >= 0.1.0, < 0.2.3

## Timeline

- 2026-06-29: advisory: GHSA-cmvp-gp9f-23xw published
- 2026-06-29: disclosed: CVE-2026-53429 published

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-53429.html](https://cna.erlef.org/cves/CVE-2026-53429.html)
- [https://github.com/leandrocp/mdex_native/commit/cbd927fb5061b488de8d90a8ef6df65718ca1fe6](https://github.com/leandrocp/mdex_native/commit/cbd927fb5061b488de8d90a8ef6df65718ca1fe6)
- [https://github.com/leandrocp/mdex_native/security/advisories/GHSA-cmvp-gp9f-23xw](https://github.com/leandrocp/mdex_native/security/advisories/GHSA-cmvp-gp9f-23xw)