EUVD-2026-40176Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The library is reached through network-facing application endpoints rendering user content; the library imposes no authentication; impact is availability-only with no scope change.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
1DescriptionCVE.org
Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mdex_native allows an attacker who controls a rendered document to cause a denial of service through unbounded native memory exhaustion.
The native rendering code permanently leaks memory when rendering a document that contains escaped-tag nodes. The conversion of each %MDEx.EscapedTag{} node into its native representation (From<ExEscapedTag> for NodeValue in the Rust NIF) calls Box::leak on the caller-supplied literal string, which surrenders the backing allocation so that it lives for the entire lifetime of the operating system process and is never freed.
Both the byte length of each literal and the number of escaped-tag nodes in a document are attacker-controlled, and there is no size cap, rate limit, or string interning on this path. Every render of a document containing escaped-tag nodes therefore leaks literal_size x node_count bytes that can never be reclaimed, and repeated renders accumulate without bound. Rendering reaches this path through the public MDEx.to_html/1 entry point and any other API that renders a supplied %MDEx.Document{}.
Any application that uses mdex (or mdex_native directly) to render documents derived from user-supplied content is affected. Because the leaked memory is never reclaimed for the life of the BEAM process, an attacker can drive resident memory upward without limit until the node exhausts memory and crashes, taking down every process on it.
The vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/types/document.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/types/document.rs), where it remains unpatched.
This issue affects mdex from 0.11.0 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.
AnalysisAI
Native Rust heap exhaustion in leandrocp mdex and mdex_native allows any attacker who can supply document content to MDEx.to_html/1 to crash the BEAM Erlang/Elixir node through unbounded memory accumulation. The Rust NIF permanently leaks memory by calling Box::leak on every escaped-tag literal string during document rendering, with no size cap or rate limit - leakage compounds across repeated renders proportional to literal_size multiplied by node_count, and the BEAM VM can never reclaim native allocations once surrendered this way. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-released patches are available in mdex 0.12.3 and mdex_native 0.2.3.
Technical ContextAI
mdex and its extracted dependency mdex_native are Elixir libraries that wrap a Rust NIF (Native Implemented Function) built on the comrak CommonMark parser. The vulnerability, identified as CWE-401 (Missing Release of Memory after Effective Lifetime), resides in the From<ExEscapedTag> for NodeValue trait implementation inside native/comrak_nif/src/types/document.rs (mdex) and native/mdex_native_nif/src/types/document.rs (mdex_native). When converting an %MDEx.EscapedTag{} Elixir struct node into its native Rust NodeValue representation, the code calls Box::leak on the caller-supplied literal string. Box::leak in Rust intentionally transfers ownership of a heap allocation to the OS process, bypassing the Rust borrow checker's drop mechanism and preventing deallocation for the entire process lifetime. Because NIFs live outside the BEAM VM's garbage-collected heap, the BEAM allocator has no visibility into these native allocations and cannot reclaim them, even between requests. The affected CPE entries are cpe:2.3:a:leandrocp:mdex and cpe:2.3:a:leandrocp:mdex_native.
RemediationAI
The primary fix is to upgrade mdex to version 0.12.3 or later and mdex_native to version 0.2.3 or later, which remove the Box::leak call in the EscapedTag conversion path; the upstream patch commit is cbd927fb5061b488de8d90a8ef6df65718ca1fe6 at https://github.com/leandrocp/mdex_native/commit/cbd927fb5061b488de8d90a8ef6df65718ca1fe6. If patching is not immediately feasible, the most targeted compensating control is to pre-validate or sanitize documents before rendering - specifically, strip or reject any %MDEx.EscapedTag{} nodes in documents sourced from untrusted user input before passing them to MDEx.to_html/1 or any other rendering API; this eliminates the vulnerable code path at the cost of losing escaped-tag rendering for user content. A secondary mitigation is to configure BEAM VM memory limits (e.g., via +MBas or OS-level cgroups) and ensure Erlang supervisors restart the node on OOM - this limits total damage but does not prevent the crash and introduces service interruption. Rate-limiting rendering endpoints is a weak compensating control since the leak is permanent and accumulates even at low request rates.
Unauthenticated denial-of-service in MDEx, an Elixir/Erlang CommonMark parsing library, lets an attacker crash the entir
Stack exhaustion in the mdex and mdex_native Elixir Markdown libraries causes entire-node denial of service when process
Unbounded memory allocation in the MDEx Elixir Markdown rendering library allows a remote unauthenticated attacker to ex
Cross-site scripting in MDEx (Elixir Markdown library by leandrocp), versions 0.8.3 through 0.13.1, allows any attacker
Stored and reflected cross-site scripting in MDEx's Lumis syntax highlighting adapter allows attackers who can submit Ma
Same weakness CWE-401 – Memory Leak
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today