CVE-2026-53531 ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)
An attacker can cause a process crash via stack overflow by submitting deeply nested LaTeX input to the RaTeX library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53531?
CVE-2026-53531 is a medium-severity denial of service vulnerability in erweixin RaTeX, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.
Which versions are affected by CVE-2026-53531?
2 open source packages ship an affected version, including ratex-parser.
| Package | Affected | Fixed in |
|---|---|---|
ratex-parser crates.io | All versions | 0.1.11 |
ratex-parser crates.io | All versions | 0.1.11 |
How do I fix CVE-2026-53531?
Upgrade ratex-parser to 0.1.11 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-53531 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53531 exists.
Sources
Also known as GHSA-4w5h-hx6r-28q7.