{"id":"EUVD-2026-64180","enisaUuid":"f89113b8-17cf-3094-8ba1-74cb807a5b31","description":"RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\\left`, `\\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic \u003d \"abort\"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.","datePublished":"Aug 21, 2026, 9:34:16 PM","dateUpdated":"Aug 25, 2026, 4:51:41 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7\n","aliases":"CVE-2026-53531\nGHSA-4w5h-hx6r-28q7\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"72d7fbfc-cca9-3371-aa49-0bba39005b95","product":{"name":"RaTeX","vendor":{"name":"erweixin"}},"product_version":"\u003c 0.1.11"}],"enisaIdVendor":[{"id":"52125f26-88b2-3222-b793-d547acfc2d77","vendor":{"name":"erweixin"}}],"enisaIdVulnerability":[{"id":"697fc78d-5eab-3c05-8106-872a58ca610a","vulnerability":{"id":"GHSA-4w5h-hx6r-28q7","description":"ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)","datePublished":"Jul 7, 2026, 11:39:30 PM","dateUpdated":"Jul 7, 2026, 11:39:30 PM","baseScore":0.0,"references":"https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7\nhttps://github.com/erweixin/RaTeX\n","enisa_id":"EUVD-2026-64180\n","aliases":"GHSA-4w5h-hx6r-28q7\nCVE-2026-53531\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f2c54b0d-8037-32af-8950-314eb0fe5826","vulnerability":{"id":"CVE-2026-53531","description":"RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\\left`, `\\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic \u003d \"abort\"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.","datePublished":"Aug 21, 2026, 9:34:16 PM","dateUpdated":"Aug 25, 2026, 4:51:41 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7\n","enisa_id":"EUVD-2026-64180\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Oct 28, 2026, 7:16:16 AM","vulnerabilityProduct":[{"id":"14c6a816-901c-336c-bc82-e5a184dfcc3f","product":{"name":"RaTeX","vendor":{"name":"erweixin"}},"product_version":"\u003c 0.1.11"}],"vulnerabilityVendor":[{"id":"36336118-996d-3db6-9043-09ee95302b7d","vendor":{"name":"erweixin"}}]}}],"enisaIdAdvisory":[]}