Executive brief
RaTeX is a tool used to parse and render LaTeX mathematical formulas. A vulnerability in its parsing engine allows an attacker to crash the entire application by providing a specially crafted, deeply nested formula. This results in a denial-of-service (DoS) condition, potentially taking down web services or applications that rely on RaTeX for math rendering.
Technical details
The ratex-parser library utilizes a recursive-descent parser that lacks a recursion depth limit. Specifically, the mutual recursion between parse_expression, parse_atom, and parse_group (as well as handle_left) consumes a native stack frame for every nesting level encountered (e.g., '{', '\sqrt{', '\left'). An attacker can provide a relatively small input (approximately 10 KB) containing deeply nested groups to exhaust the stack memory, triggering a fatal SIGABRT and crashing the process. This is reachable via unauthenticated network requests in typical math-rendering service deployments. The issue is fixed in version 0.1.11.
Affected products
- erweixin/RaTeX ratex-parser < 0.1.11
Timeline
- 2026-05-31: disclosed
- 2026-07-07: advisory: GitHub Advisory published
- 2026-07-07: patched
References
- https://api.github.com/users/nikkoenggaliano
- https://github.com/nikkoenggaliano
- https://api.github.com/users/nikkoenggaliano/gists%7B/gist_id%7D
- https://api.github.com/users/nikkoenggaliano/repos
- https://avatars.githubusercontent.com/u/37658579?v=4
- https://api.github.com/users/nikkoenggaliano/events%7B/privacy%7D