Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53426— Atom-table exhaustion denial-of-service via JSON parse_document in MDEx

Quick assessment

Affected
leandrocp mdex
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

leandrocp mdex是加拿大leandrocp个人开发者的一个依赖解析工具。 leandrocp mdex 0.4.3版本至0.13.2之前版本存在资源管理错误漏洞，该漏洞源于资源分配无限制或节流，函数json_to_node/1将攻击者控制的node_type值传递给Module.concat/1，调用String.to_atom/1为每个不同的值创建新原子，原子不会被垃圾回收，导致特制JSON文档耗尽原子表（约1,048,576个原子），使整个Erlang虚拟机中止，可能导致未经身份验证的拒绝

AI Predicted 7.5 Difficulty: Easy EPSS 0.18% · P7

Affected Version Matrix 2

VendorProduct Version RangeStatus
leandrocp mdex 0.4.3< 0.13.2 affected
cbb59a3f792dbc343873adec3466f49c853dc309< 00fddf444220a1f1cc0af0a1cab6738804878387 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53426

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Atom-table exhaustion denial-of-service via JSON parse_document in MDEx
Source: CVE Program / CVE List V5
Vulnerability Description
Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.parse_document/2 accepts a {:json, json} source. In lib/mdex.ex, the private json_to_node/1 function passes the attacker-controlled node_type value to Module.concat/1, which calls String.to_atom/1 and interns a brand-new atom for every distinct value. Atoms are never garbage collected on the BEAM, so a crafted JSON document carrying a unique node_type at each (deeply nested) node mints one permanent atom per node. A single document can intern hundreds of thousands of atoms, and a large enough document exhausts the default atom table (around 1,048,576 atoms) and aborts the entire Erlang VM, taking down every process on the node. Any application that passes untrusted input to the {:json, ...} source of MDEx.parse_document is exposed to an unauthenticated denial-of-service. This issue affects mdex from 0.4.3 before 0.13.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
leandrocp mdex 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
leandrocp mdex是加拿大leandrocp个人开发者的一个依赖解析工具。 leandrocp mdex 0.4.3版本至0.13.2之前版本存在资源管理错误漏洞，该漏洞源于资源分配无限制或节流，函数json_to_node/1将攻击者控制的node_type值传递给Module.concat/1，调用String.to_atom/1为每个不同的值创建新原子，原子不会被垃圾回收，导致特制JSON文档耗尽原子表（约1,048,576个原子），使整个Erlang虚拟机中止，可能导致未经身份验证的拒绝
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
leandrocp mdex 0.4.3 ~ 0.13.2 cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*
leandrocp mdex cbb59a3f792dbc343873adec3466f49c853dc309 ~ 00fddf444220a1f1cc0af0a1cab6738804878387 cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-53426

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53426

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53426 (1)

Vendor Advisories for CVE-2026-53426 (3)

Same Patch Batch · leandrocp · 2026-06-29 · 6 CVEs total

CVE-2026-53429 Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial
CVE-2026-53428 Unbounded memory allocation in highlight_lines range expansion in mdex
CVE-2026-53427 Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute
CVE-2026-54888 Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex
CVE-2026-54889 Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)

IV. Related Vulnerabilities

Same product: mdex
Same vendor: leandrocp
Same weakness: CWE-770