CVE-2026-124683
Received Received - Intake

Inefficient Tokenization in Langium DoS Vulnerability

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: Eclipse Foundation

Description
Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-124683
EUVD
EUVD-2026-120086

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse Langium From 3.2.0 (inc) to 4.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Eclipse Langium versions 3.2.0 to 4.4.0 have an inefficient line number calculation in the IndentationAwareTokenBuilder and IndentationAwareLexer. When processing DEDENT tokens, it rescans the entire document text repeatedly, causing quadratic time complexity. This leads to severe performance degradation when tokenizing documents with frequent indentation changes.

Detection Guidance

To detect this vulnerability, monitor Node.js processes for unusually long tokenization times when processing indentation-sensitive documents. Check for high CPU usage in Langium-based applications during document parsing. No specific commands are provided in the context.

Impact Analysis

An attacker can exploit this by submitting a crafted document with rapidly changing indentation. This causes the Node.js event loop to hang for tens of seconds, denying service to all users sharing the same process. A 708KB document can freeze the event loop for nearly 70 seconds.

Compliance Impact

This vulnerability primarily causes denial-of-service (DoS) conditions by freezing the Node.js event loop, which could disrupt availability of services. For compliance standards like GDPR or HIPAA, which require availability of personal or health data systems, such disruptions may violate requirements for timely access and system reliability.

Mitigation Strategies

Update Eclipse Langium to a version that fixes the inefficient line number calculation in IndentationAwareLexer and IndentationAwareTokenBuilder. Replace the O(n²) line number scanning with an incremental counter or precomputed newline-offset index. Restart affected Node.js processes after applying the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124683. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...