erweixin RaTeX up to 0.1.10 Public Parser Cargo.toml ratex_parser::parse denial of service

Summaryinfo

A vulnerability described as problematic has been identified in erweixin RaTeX up to 0.1.10. Affected by this issue is the function ratex_parser::parse of the file Cargo.toml of the component Public Parser. Executing a manipulation can lead to denial of service. This vulnerability is tracked as CVE-2026-53530. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in erweixin RaTeX up to 0.1.10. It has been declared as problematic. This vulnerability affects the function ratex_parser::parse of the file Cargo.toml of the component Public Parser. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. CVE summarizes:

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with byte indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“byte index 1 is not a char boundary”*. Because RaTeX’s release profile sets `panic = "abort"` (`Cargo.toml:48`), the panic aborts the entire process — not just the current request/thread — making this a hard denial of service for any service that renders untrusted LaTeX. Version 0.1.11 fixes the issue.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-53530 since 06/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 0.1.11 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• erweixin

Name

• RaTeX

Version

• 0.1.0
• 0.1.1
• 0.1.2
• 0.1.3
• 0.1.4
• 0.1.5
• 0.1.6
• 0.1.7
• 0.1.8
• 0.1.9
• 0.1.10

Website

• Product: https://github.com/erweixin/RaTeX/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion