CVE-2026-53426

Name of the Vulnerable Software and Affected Versions leandrocp MDEx versions 0.4.3 through 0.13.1

Description An excessive allocation issue exists when the MDEx.parse document/2 function accepts a {:json, json} source. The private json to node/1 function passes an attacker-controlled node type value to Module.concat/1, which subsequently calls String.to atom/1. This process creates a new atom for every distinct value provided. Because atoms are not garbage collected on the BEAM (the Erlang Virtual Machine), a specially crafted JSON document with unique node type values at each deeply nested node can exhaust the default atom table. This leads to an unauthenticated denial-of-service by aborting the entire Erlang VM and terminating all processes on the node.

Recommendations Update leandrocp MDEx to version 0.13.2 or later. As a temporary workaround, do not pass untrusted or attacker-controlled input to the {:json, ...} source of MDEx.parse document/2.