CVE-2026-53530

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with byte indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“byte index 1 is not a char boundary”*. Because RaTeX’s release profile sets `panic = "abort"` (`Cargo.toml:48`), the panic aborts the entire process — not just the current request/thread — making this a hard denial of service for any service that renders untrusted LaTeX. Version 0.1.11 fixes the issue.

CVSS

No CVSS.

References

Link	Resource
https://github.com/erweixin/RaTeX/security/advisories/GHSA-4hgp-59h5-gvrj
https://github.com/erweixin/RaTeX/security/advisories/GHSA-4hgp-59h5-gvrj

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) RaTeX es un motor de renderizado de matemáticas compatible con KaTeX escrito en Rust. Antes de la versión 0.1.11, el punto de entrada del analizador público 'ratex_parser::parse(&str)' entra en pánico con la entrada de 9 bytes '\verbéxé' (es decir, '\verb' seguido por el delimitador no ASCII 'é'). Al manejar un comando '\verb', el analizador segmenta el argumento verbatim con índices de bytes ('arg[1..arg.len() - 1]'); si el carácter delimitador es UTF-8 multibyte, el índice '1' cae dentro de ese carácter y Rust entra en pánico con 'byte index 1 is not a char boundary'. Debido a que el perfil de lanzamiento de RaTeX establece 'panic = “abort”' ('Cargo.toml:48'), el pánico aborta todo el proceso - no solo la solicitud/hilo actual - haciendo de esto una dura denegación de servicio para cualquier servicio que renderice LaTeX no confiable. La versión 0.1.11 corrige el problema.

Information

Published : 2026-08-21 22:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-53530

Mitre link : CVE-2026-53530

CVE.ORG link : CVE-2026-53530

JSON object : View

Products Affected

No product.

CWE

CWE-248

Uncaught Exception

CWE-400

Uncontrolled Resource Consumption

CWE-1285

Improper Validation of Specified Index, Position, or Offset in Input

{"id": "CVE-2026-53530", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53530", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T20:04:54.916424Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "erweixin", "product": "RaTeX", "versions": [{"status": "affected", "version": "< 0.1.11"}]}]}], "published": "2026-08-21T22:16:39.590", "references": [{"url": "https://github.com/erweixin/RaTeX/security/advisories/GHSA-4hgp-59h5-gvrj", "source": "security-advisories@github.com"}, {"url": "https://github.com/erweixin/RaTeX/security/advisories/GHSA-4hgp-59h5-gvrj", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-248"}, {"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-1285"}]}], "descriptions": [{"lang": "en", "value": "RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte input `\\verb\u00e9x\u00e9` (i.e. `\\verb` followed by the non-ASCII delimiter `\u00e9`). When handling a `\\verb` command, the parser slices the verbatim argument with byte indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *\u201cbyte index 1 is not a char boundary\u201d*. Because RaTeX\u2019s release profile sets `panic = \"abort\"` (`Cargo.toml:48`), the panic aborts the entire process \u2014 not just the current request/thread \u2014 making this a hard denial of service for any service that renders untrusted LaTeX. Version 0.1.11 fixes the issue."}, {"lang": "es", "value": "RaTeX es un motor de renderizado de matem\u00e1ticas compatible con KaTeX escrito en Rust. Antes de la versi\u00f3n 0.1.11, el punto de entrada del analizador p\u00fablico 'ratex_parser::parse(&str)' entra en p\u00e1nico con la entrada de 9 bytes '\\verb\u00e9x\u00e9' (es decir, '\\verb' seguido por el delimitador no ASCII '\u00e9'). Al manejar un comando '\\verb', el analizador segmenta el argumento verbatim con \u00edndices de bytes ('arg[1..arg.len() - 1]'); si el car\u00e1cter delimitador es UTF-8 multibyte, el \u00edndice '1' cae dentro de ese car\u00e1cter y Rust entra en p\u00e1nico con 'byte index 1 is not a char boundary'. Debido a que el perfil de lanzamiento de RaTeX establece 'panic = \u201cabort\u201d' ('Cargo.toml:48'), el p\u00e1nico aborta todo el proceso - no solo la solicitud/hilo actual - haciendo de esto una dura denegaci\u00f3n de servicio para cualquier servicio que renderice LaTeX no confiable. La versi\u00f3n 0.1.11 corrige el problema."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "security-advisories@github.com"}