CVE-2026-53531

Name of the Vulnerable Software and Affected Versions RaTeX versions prior to 0.1.11

Description RaTeX is a KaTeX-compatible math rendering engine written in Rust. The recursive-descent parser lacks a maximum depth limit when processing nesting levels such as {, left, sqrt{, and ^{. This allows a small input of nested groups to overflow the main-thread stack, resulting in a fatal SIGABRT and an unrecoverable, whole-process denial of service. The issue occurs because mutual recursion between parse expression(), parse atom(), and parse group() does not have a depth guard, and the handle left function adds further recursive edges.

Recommendations Update RaTeX to version 0.1.11.