Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53428— Unbounded memory allocation in highlight_lines range expansion in mdex

Quick assessment

Affected
leandrocp mdex
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

leandrocp mdex是加拿大leandrocp个人开发者的一个依赖解析工具。 leandrocp mdex 0.11.0版本至0.12.3之前版本存在资源管理错误漏洞，该漏洞源于comrak_nif::lumis_adapter::LumisAdapter::parse_highlight_lines函数在处理限制代码块中的highlight_lines装饰器时，未对用户控制的行范围大小进行限制，导致可以通过无界内存分配造成拒绝服务攻击。

AI Predicted 7.5 Difficulty: Easy EPSS 0.18% · P8

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 4

VendorProduct Version RangeStatus
leandrocp mdex 0.11.0< 0.12.3 affected
a8407611715d1ead35fbcba79c72cef1b7df387b< 6ed94d905f97af188323f042698ae841c02293b4 affected
leandrocp mdex_native 0.1.0< 0.2.3 affected
956528c5e31746253347029e810a969ab916fd27< 798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53428

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unbounded memory allocation in highlight_lines range expansion in mdex
Source: CVE Program / CVE List V5
Vulnerability Description
Memory Allocation with Excessive Size Value vulnerability in leandrocp mdex allows an unauthenticated attacker to cause a denial of service through unbounded memory allocation. comrak_nif::lumis_adapter::LumisAdapter::parse_highlight_lines in native/comrak_nif/src/lumis_adapter.rs eagerly expands a user-controlled inclusive line range from a fenced code block's highlight_lines decorator into a Vec<usize>, pushing one element per integer in the range with no upper bound on the range size. An attacker who can supply Markdown that an application renders with MDEx.to_html/2 (for example a comment, chat message, or wiki page) can embed a code block whose info string is rust highlight_lines="1-100000000", forcing the native adapter to allocate roughly 8 bytes per line in the range. A payload that differs by only a few bytes can therefore allocate hundreds of megabytes, and a sufficiently large range (for example 1-2000000000) exhausts host memory and aborts the BEAM, denying service to every user of the rendering process. The per-line write loop additionally tests membership with a linear scan over the same vector, degrading rendering to a quadratic cost even for ranges that do not immediately exhaust memory. The vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched. This issue affects mdex from 0.11.0 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5
Vulnerability Title
leandrocp mdex 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
leandrocp mdex是加拿大leandrocp个人开发者的一个依赖解析工具。 leandrocp mdex 0.11.0版本至0.12.3之前版本存在资源管理错误漏洞，该漏洞源于comrak_nif::lumis_adapter::LumisAdapter::parse_highlight_lines函数在处理限制代码块中的highlight_lines装饰器时，未对用户控制的行范围大小进行限制，导致可以通过无界内存分配造成拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
leandrocp mdex 0.11.0 ~ 0.12.3 cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*
leandrocp mdex a8407611715d1ead35fbcba79c72cef1b7df387b ~ 6ed94d905f97af188323f042698ae841c02293b4 cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*
leandrocp mdex_native 0.1.0 ~ 0.2.3 cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*
leandrocp mdex_native 956528c5e31746253347029e810a969ab916fd27 ~ 798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3 cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-53428

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53428

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-53428 (3)

Same Patch Batch · leandrocp · 2026-06-29 · 6 CVEs total

CVE-2026-53429 Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial
CVE-2026-53426 Atom-table exhaustion denial-of-service via JSON parse_document in MDEx
CVE-2026-53427 Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute
CVE-2026-54888 Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex
CVE-2026-54889 Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)

IV. Related Vulnerabilities

Same product: mdex
Same vendor: leandrocp
Same weakness: CWE-789