Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-124683

Quick assessment

Affected
Eclipse Foundation Eclipse Langium
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Eclipse Langium 版本 3.2.0 至 4.4.0 中，在可选启用的 IndentationAwareTokenBuilder 和 IndentationAwareLexer 组件中存在算法复杂度低效的问题（CWE-407）。在生成 DEDENT 令牌时，令牌构建器会重新扫描整个前文文档以重新计算行号。若文档中大多数行的缩进发生变化，则令牌化过程的时间复杂度将呈二次增长。由于令牌化是同步执行的，一个仅几百字节的精心构造文档即可阻塞 Node.js 事件循环长达数十秒，从而导致同一进程中所有用户遭受拒绝

CVSS 8.7 · High

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Affected Version Matrix 1

VendorProduct Version RangeStatus
Eclipse Foundation Eclipse Langium 3.2.0≤ 4.4.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-124683

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse Langium 3.2.0 ~ 4.4.0 -

II. Public POCs for CVE-2026-124683

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-124683

请登录查看更多情报信息。

Other References for CVE-2026-124683 (3)

Same Patch Batch · Eclipse Foundation · 2026-11-09 · 3 CVEs total

CVE-2026-123870 9.5 CRITICAL [Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string
CVE-2026-118492 2.0 LOW Eclipse Langium 3.0+ langium-sprotty 跨站脚本漏洞

IV. Related Vulnerabilities

Same product: Eclipse Langium
Same vendor: Eclipse Foundation
Same weakness: CWE-407