GHSA-4W5H-HX6R-28Q7
Vulnerability from github – Published: 2026-07-07 23:39 – Updated: 2026-07-07 23:39Summary
RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at {, \left, \sqrt{, ^{, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With panic = "abort" (Cargo.toml:48), and because a Rust stack overflow is always a fatal SIGABRT regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string.
Details
The mutual recursion has no depth guard (crates/ratex-parser/src/parser.rs):
parse_expression (:113) -> parse_atom (:281/285) -> parse_group (:451)
^ |
| on '{' (:459) recurse |
+--------------------------+
\left adds another recursive edge: handle_left → parse_expression (crates/ratex-parser/src/functions/left_right.rs:47). The only counters present are unrelated to depth: leftright_depth (a \right-matching counter, parser.rs:24) and the macro expander’s max_expand = 1000 (macro_expander.rs:64), which does not gate brace / \left recursion (those tokens never pass through expand_once). There is no recursion_limit/depth parameter on parse_group, parse_expression, or parse_atom.
PoC
$ python3 -c 'import sys;sys.stdout.write("{"*200000+"x"+"}"*200000)' | ./target/release/parse
thread 'main' has overflowed its stack
fatal runtime error: stack overflow, aborting
Aborted (core dumped) # exit 134
(Other nesting forms work equally, e.g. \left(×N, \sqrt{×N, ^{×N.)
Impact
A single small request crashes the whole RaTeX process. In a typical server-side math-rendering service this is a reliable, unauthenticated DoS; on smaller worker-thread stacks (e.g. a 512 KB async runtime thread) only a few hundred bytes of nesting are required.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "ratex-parser"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-53531"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-07T23:39:30Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\n\nRaTeX\u2019s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\\left`, `\\sqrt{`, `^{`, etc, with **no maximum depth limit**. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = \"abort\"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string.\n\n### Details\n\nThe mutual recursion has no depth guard (`crates/ratex-parser/src/parser.rs`):\n\n```\nparse_expression (:113) -\u003e parse_atom (:281/285) -\u003e parse_group (:451)\n ^ |\n | on \u0027{\u0027 (:459) recurse |\n +--------------------------+\n```\n\n`\\left` adds another recursive edge: `handle_left` \u2192 `parse_expression` (`crates/ratex-parser/src/functions/left_right.rs:47`). The only counters present are unrelated to depth: `leftright_depth` (a `\\right`-matching counter, `parser.rs:24`) and the macro expander\u2019s `max_expand = 1000` (`macro_expander.rs:64`), which does **not** gate brace / `\\left` recursion (those tokens never pass through `expand_once`). There is no `recursion_limit`/depth parameter on `parse_group`, `parse_expression`, or `parse_atom`.\n\n### PoC\n\n\u003cimg width=\"1097\" height=\"158\" alt=\"image\" src=\"https://github.com/user-attachments/assets/29b837a2-c455-4cb6-a055-514b31c999c6\" /\u003e\n\n\n```\n$ python3 -c \u0027import sys;sys.stdout.write(\"{\"*200000+\"x\"+\"}\"*200000)\u0027 | ./target/release/parse\nthread \u0027main\u0027 has overflowed its stack\nfatal runtime error: stack overflow, aborting\nAborted (core dumped) # exit 134\n```\n\n(Other nesting forms work equally, e.g. `\\left(`\u00d7N, `\\sqrt{`\u00d7N, `^{`\u00d7N.)\n\n### Impact\n\nA single small request crashes the whole RaTeX process. In a typical server-side math-rendering service this is a reliable, unauthenticated DoS; on smaller worker-thread stacks (e.g. a 512 KB async runtime thread) only a few hundred bytes of nesting are required.",
"id": "GHSA-4w5h-hx6r-28q7",
"modified": "2026-07-07T23:39:30Z",
"published": "2026-07-07T23:39:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7"
},
{
"type": "PACKAGE",
"url": "https://github.com/erweixin/RaTeX"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.