leandrocp mdex up to 0.13.1 JSON lib/mdex.ex allocation of resources

Summaryinfo

A vulnerability labeled as problematic has been found in leandrocp mdex up to 0.13.1. Affected is an unknown function in the library lib/mdex.ex of the component JSON Handler. Executing a manipulation can lead to allocation of resources. This vulnerability is tracked as CVE-2026-53426. The attack is restricted to local execution. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in leandrocp mdex up to 0.13.1 and classified as problematic. This vulnerability affects an unknown part in the library lib/mdex.ex of the component JSON Handler. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. CVE summarizes:

Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.parse_document/2 accepts a {:json, json} source. In lib/mdex.ex, the private json_to_node/1 function passes the attacker-controlled node_type value to Module.concat/1, which calls String.to_atom/1 and interns a brand-new atom for every distinct value. Atoms are never garbage collected on the BEAM, so a crafted JSON document carrying a unique node_type at each (deeply nested) node mints one permanent atom per node. A single document can intern hundreds of thousands of atoms, and a large enough document exhausts the default atom table (around 1,048,576 atoms) and aborts the entire Erlang VM, taking down every process on the node. Any application that passes untrusted input to the {:json, ...} source of MDEx.parse_document is exposed to an unauthenticated denial-of-service. This issue affects mdex from 0.4.3 before 0.13.2.

The weakness was disclosed by Peter Ullrich and Jonatan Männchen as GHSA-923r-7vf4-5vw8. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-53426 since 06/09/2026. The exploitation appears to be easy. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 0.13.2 eliminates this vulnerability. Applying the patch 00fddf444220a1f1cc0af0a1cab6738804878387 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• leandrocp

Name

• mdex

Version

• 0.13.0
• 0.13.1

License

• open-source

Website

• Product: https://github.com/leandrocp/mdex/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion