Executive brief
A vulnerability in the mdex Markdown processing library can allow an attacker to crash an entire Elixir or Erlang application. By providing a specially crafted Markdown document with deeply nested elements, an attacker can trigger a system-level failure that the application cannot recover from. This results in a complete denial of service for all users and processes running on the affected server node.
Technical details
The vulnerability is an uncontrolled recursion (CWE-674) located in the Rust NIF (Native Implemented Function) component of the mdex library. Specifically, the functions `ex_document_to_comrak_ast` and `comrak_ast_to_ex_document` in `document.rs` lack nesting depth limits when converting between Elixir structs and Comrak's internal AST. An attacker can provide a Markdown document with thousands of nested block quotes to exhaust the native C stack, triggering an uncatchable SIGSEGV. Because this occurs within a NIF, it bypasses the Erlang runtime's fault tolerance and terminates the entire BEAM process. The issue was fixed by replacing recursive logic with an iterative, stack-based conversion in mdex 0.12.3 and mdex_native 0.2.3.
Affected products
- leandrocp mdex 0.3.0 before 0.12.3
- leandrocp mdex_native 0.1.0 before 0.2.3
Timeline
- 2026-06-19: patched: Initial patch commit in mdex_native repository
- 2026-06-29: advisory: CVE published and NVD record created