CVE-2026-53531

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.

CVSS

No CVSS.

References

Link	Resource
https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7
https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) RaTeX es un motor de renderizado de matemáticas compatible con KaTeX escrito en Rust. Antes de la versión 0.1.11, el analizador descendente recursivo de RaTeX recurre a uno (o más) marcos de pila nativos por nivel de anidamiento en '{', '\left', '\sqrt{', '^{', etc., sin límite máximo de profundidad. Una entrada corta de ~10 KB de grupos anidados causa un desbordamiento de pila en la pila del hilo principal de 8 MB y aborta el proceso. Con 'panic = “abort”' ('Cargo.toml:48'), y debido a que un desbordamiento de pila de Rust es siempre un 'SIGABRT' fatal independientemente de la estrategia de pánico, esto es una denegación de servicio de proceso completo e irrecuperable alcanzable desde una única cadena LaTeX no confiable. La versión 0.1.11 corrige el problema.

Information

Published : 2026-08-21 22:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-53531

Mitre link : CVE-2026-53531

CVE.ORG link : CVE-2026-53531

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-674

Uncontrolled Recursion

{"id": "CVE-2026-53531", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53531", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T16:51:02.684429Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "erweixin", "product": "RaTeX", "versions": [{"status": "affected", "version": "< 0.1.11"}]}]}], "published": "2026-08-21T22:16:39.737", "references": [{"url": "https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7", "source": "security-advisories@github.com"}, {"url": "https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX\u2019s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\\left`, `\\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = \"abort\"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue."}, {"lang": "es", "value": "RaTeX es un motor de renderizado de matem\u00e1ticas compatible con KaTeX escrito en Rust. Antes de la versi\u00f3n 0.1.11, el analizador descendente recursivo de RaTeX recurre a uno (o m\u00e1s) marcos de pila nativos por nivel de anidamiento en '{', '\\left', '\\sqrt{', '^{', etc., sin l\u00edmite m\u00e1ximo de profundidad. Una entrada corta de ~10 KB de grupos anidados causa un desbordamiento de pila en la pila del hilo principal de 8 MB y aborta el proceso. Con 'panic = \u201cabort\u201d' ('Cargo.toml:48'), y debido a que un desbordamiento de pila de Rust es siempre un 'SIGABRT' fatal independientemente de la estrategia de p\u00e1nico, esto es una denegaci\u00f3n de servicio de proceso completo e irrecuperable alcanzable desde una \u00fanica cadena LaTeX no confiable. La versi\u00f3n 0.1.11 corrige el problema."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "security-advisories@github.com"}