{"id":"RUSTSEC-2026-0311","revision":null,"records":[{"revision":"4a89bc8eb0834558856c77559c445eac","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0311","aliases":[],"title":"Stack overflow on deeply nested LaTeX input","description":"The parser and layout engine in affected versions of `latex-rust` recurse once\nper level of nesting with no limit. Deeply nested input, such as `\\frac{1}{…}`,\nbraces, `\\sqrt{…}`, `\\left(`, or superscripts nested hundreds or thousands of\nlevels deep, exhausts the call stack.\n\nA stack overflow in Rust aborts the process. It is not a panic, so it cannot be\ncaught with `catch_unwind`. A program that renders LaTeX from untrusted input\ncan therefore be terminated by a short string. With a release build on an 8 MiB\nstack, 700 nested `\\frac{1}{…}` (about 7 KB of input) abort version 1.0.4, and\n10,000 nested braces (about 20 KB) abort it as well. The threshold is lower on\nsmaller stacks and in debug builds; on a 2 MiB thread in a debug build, about\n35 nested fractions are enough.\n\n```rust\nlet mut src = String::from(\"1\");\nfor _ in 0..700 {\n    src = format!(\"\\\\frac{{1}}{{{src}}}\");\n}\nlet _ = latex_rust::parse(&src); // stack overflow, process aborts\n```\n\nThe fixed versions count nesting depth in the parser and in `layout` and\nrefuse input that nests more than 32 levels. `parse`, `parse_with_colors`, and\nthe `latex_to_*` functions return\n`ParseError::Malformed(\"input nests deeper than 32 levels\")`, and `layout`\nreturns `Error::Unsupported { what: \"tree nests deeper than 32 levels\" }` for a\ntree built by hand. The count is of parser recursion levels, and a braced\nargument costs two, so the limit admits 15 nested `\\frac`, `\\sqrt`, or\n`x^{…}`, and 31 nested groups, `\\left…\\right` pairs, or environments. Input\npast the limit is refused within about 100 KiB of stack in an optimised build.\n\nVersion 1.0.5 fixes this with no API changes and is a drop-in replacement for\n1.0.4; upgrade with `cargo update -p latex-rust`. It also includes the 2.0.0\nrendering fixes, so rendered output differs from 1.0.4. Versions 2.0.0 and\n2.0.1 contain the same fix, with the same limit and messages, together with\nbreaking API changes relative to 1.x, and also let callers change the limit\nwith `ParseOptions` and `layout_with_max_depth`.","state":0,"publishedAt":"2026-09-27T12:00:00+00:00","modifiedAt":"2026-09-28T08:45:03.0803767+00:00","affected":[{"ecosystem":"crates.io","name":"latex-rust","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"1.0.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/latex-rust","https://rustsec.org/advisories/RUSTSEC-2026-0311.html","https://github.com/jscarr64/LaTeX-Rust/issues/6","https://github.com/jscarr64/LaTeX-Rust/pull/10","https://github.com/jscarr64/LaTeX-Rust/releases/tag/v1.0.5"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0311","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0311","identifiers":["RUSTSEC-2026-0311"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T08:55:39.4193399+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T08:55:39.4193399+00:00","lastSuccessAt":"2026-11-12T08:55:39.5669336+00:00","error":null,"lastVerifiedAt":"2026-11-12T08:55:39.5669352+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-cdca8464672f7a6b0a4c4e58984a9b57c5e15d71ae2ddc7e2ff782639942ab38","complete":true,"records":424631,"lastAttemptAt":"2026-11-12T08:53:35.355196+00:00","lastSuccessAt":"2026-11-12T08:53:35.3149634+00:00","error":null,"lastVerifiedAt":"2026-11-12T08:53:35.355196+00:00","snapshotPublishedAt":"2026-11-12T08:30:19+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-570328139368428ca550af1570d01579","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T08:56:06.8263277+00:00","lastSuccessAt":"2026-11-12T06:55:06.923+00:00","error":null,"lastVerifiedAt":"2026-11-12T06:55:06.923+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T08:55:39.4193399+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T08:55:39.4193399+00:00","lastSuccessAt":"2026-11-12T08:55:39.5676932+00:00","error":null,"lastVerifiedAt":"2026-11-12T08:55:39.5676956+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-723ec20d092d41278189b87b8cbcf51e","complete":false,"records":13760,"lastAttemptAt":"2026-11-12T08:56:05.5820299+00:00","lastSuccessAt":"2026-11-12T08:56:05.578+00:00","error":null,"lastVerifiedAt":"2026-11-12T08:56:05.578+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13313,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T08:55:35.2753592+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T08:55:35.2753592+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T08:53:35.4094441+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T08:53:35.4094441+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-44cd3a7b61439dd4e0dd867616b5261e169a9e59821f22444c84d86fd81b6f2e","complete":true,"records":3106,"lastAttemptAt":"2026-11-12T08:55:39.3774946+00:00","lastSuccessAt":"2026-11-12T08:55:39.2342768+00:00","error":null,"lastVerifiedAt":"2026-11-12T08:55:39.3774946+00:00","snapshotPublishedAt":"2026-11-12T08:18:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-c924bd892f7cff2008ba8f06b2d1a456e8a821e4c475408ea0c699c9c1fbf82c","complete":true,"records":231700,"lastAttemptAt":"2026-11-12T08:55:35.1386298+00:00","lastSuccessAt":"2026-11-12T08:55:33.6769659+00:00","error":null,"lastVerifiedAt":"2026-11-12T08:55:35.1386298+00:00","snapshotPublishedAt":"2026-11-12T08:33:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}