CVE-2026-124683 Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTok
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124683?
CVE-2026-124683 is a high-severity vulnerability in Eclipse Langium, published on 9 Nov 2026.
Official description
Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected.
Weakness: CWE-407
Which versions are affected by CVE-2026-124683?
How do I fix CVE-2026-124683?
No fix has been published for CVE-2026-124683 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124683 being exploited?
There is no known exploitation of CVE-2026-124683 in the wild and no public exploit code.
Sources
Also known as GHSA-297v-g8mm-qj4h, GHSA-mw8j-wq3m-9899.