EUVD-2026-64180
GHSA-4w5h-hx6r-28q7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via untrusted LaTeX input with no authentication or preconditions; sole impact is reliable full-process crash (A:H); no confidentiality or integrity effect.
Primary rating from Vendor (https://github.com/erweixin/RaTeX).
CVSS VectorVendor: https://github.com/erweixin/RaTeX
Lifecycle Timeline
2DescriptionCVE.org
Summary
RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at {, \left, \sqrt{, ^{, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With panic = "abort" (Cargo.toml:48), and because a Rust stack overflow is always a fatal SIGABRT regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string.
Details
The mutual recursion has no depth guard (crates/ratex-parser/src/parser.rs):
parse_expression (:113) -> parse_atom (:281/285) -> parse_group (:451)
^ |
| on '{' (:459) recurse |
+--------------------------+\left adds another recursive edge: handle_left → parse_expression (crates/ratex-parser/src/functions/left_right.rs:47). The only counters present are unrelated to depth: leftright_depth (a \right-matching counter, parser.rs:24) and the macro expander’s max_expand = 1000 (macro_expander.rs:64), which does not gate brace / \left recursion (those tokens never pass through expand_once). There is no recursion_limit/depth parameter on parse_group, parse_expression, or parse_atom.
PoC
<img width="1097" height="158" alt="image" src="https://github.com/user-attachments/assets/29b837a2-c455-4cb6-a055-514b31c999c6" />
$ python3 -c 'import sys;sys.stdout.write("{"*200000+"x"+"}"*200000)' | ./target/release/parse
thread 'main' has overflowed its stack
fatal runtime error: stack overflow, aborting
Aborted (core dumped)
# exit 134(Other nesting forms work equally, e.g. \left(×N, \sqrt{×N, ^{×N.)
Impact
A single small request crashes the whole RaTeX process. In a typical server-side math-rendering service this is a reliable, unauthenticated DoS; on smaller worker-thread stacks (e.g. a 512 KB async runtime thread) only a few hundred bytes of nesting are required.
AnalysisAI
Unbounded recursive descent in the RaTeX Rust crate ratex-parser crashes the entire host process when fed deeply nested LaTeX input. The mutual recursion across parse_expression, parse_atom, and parse_group in crates/ratex-parser/src/parser.rs carries no depth guard, so roughly 200,000 nested braces (~400 KB of input, or far less on async worker threads with 512 KB stacks) exhausts the native OS stack and triggers a fatal SIGABRT from which the process cannot recover. In any server-side math rendering deployment that accepts untrusted LaTeX, this constitutes a reliable unauthenticated denial-of-service; publicly available exploit code confirms trivial reproduction with a Python one-liner.
Technical ContextAI
RaTeX is a Rust-based LaTeX rendering library whose parser (CPE: pkg:rust/ratex-parser) implements mutual recursion: parse_expression (parser.rs:113) calls parse_atom (parser.rs:281/285), which calls parse_group (parser.rs:451), which recurses back into parse_expression on every opening brace at line 459. An additional recursive edge exists via handle_left → parse_expression in crates/ratex-parser/src/functions/left_right.rs:47, triggered by \left tokens. Rust programs execute on native OS stacks - typically 8 MB for the main thread, as small as 512 KB for async runtime threads (e.g., Tokio). Because none of these functions carry a depth parameter or counter, every nesting level consumes one additional stack frame. The existing macro expander limit max_expand = 1000 (macro_expander.rs:64) does not intercept brace or \left tokens and provides no protection. With panic = "abort" set in Cargo.toml:48, and because Rust stack overflows unconditionally deliver SIGABRT regardless of panic strategy, the crash is unrecoverable at the process level. CWE-400 (Uncontrolled Resource Consumption) correctly classifies the root cause as an absent resource bound on recursive stack depth.
RemediationAI
No patched version of ratex-parser is confirmed in the advisory data at time of analysis. The definitive fix is to introduce a recursion depth counter passed through parse_group, parse_expression, and parse_atom, returning a structured parse error rather than recursing when depth exceeds a safe threshold (1,000-2,000 levels is a practical ceiling for legitimate LaTeX). The existing max_expand = 1000 macro expander limit is not a substitute and must not be relied upon as a control. Monitor https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7 for a patched release. As an immediate compensating control, operators should isolate the ratex-parser invocation in a separate subprocess with a configurable timeout and hard memory/stack limits (e.g., via ulimit -s on Linux), accepting added latency and inter-process communication overhead. Application-layer input length capping (e.g., reject LaTeX strings exceeding a few kilobytes) raises the bar but does not eliminate the risk, since the PoC uses only ~400 KB and smaller stacks require even less. Rate limiting at the API layer reduces the blast radius of repeated DoS attempts but does not prevent a single request from killing the process.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today