CVE-2026-53530

Received Received - Intake

Denial of Service in RaTeX Rust Parser

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with byte indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“byte index 1 is not a char boundary”*. Because RaTeX’s release profile sets `panic = "abort"` (`Cargo.toml:48`), the panic aborts the entire process — not just the current request/thread — making this a hard denial of service for any service that renders untrusted LaTeX. Version 0.1.11 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-53530

Affected Vendors & Products

Vendor	Product	Version / Range
ratex	ratex	to 0.1.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-248	An exception is thrown from a function, but it is not caught.
CWE-1285	The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.

Attack-Flow Graph

Executive Summary

RaTeX is a Rust-based math rendering engine compatible with KaTeX. The vulnerability exists in versions before 0.1.11 where the parser crashes when processing a specific 9-byte input containing a malformed verbatim command with non-ASCII characters. The crash occurs because the parser incorrectly handles byte indices for multibyte UTF-8 characters, causing a panic that aborts the entire process due to RaTeX's panic settings.

Detection Guidance

This vulnerability can be detected by testing RaTeX versions prior to 0.1.11 with the specific input string '\verbéxé'. If the process crashes, the vulnerable version is in use. Use: echo '\verbéxé' | ratex_parser --parse or similar command depending on your setup.

Impact Analysis

This vulnerability can be exploited to crash any service using RaTeX to render untrusted LaTeX input. Since the panic aborts the entire process, it results in a denial of service, making the service unavailable until restarted. This affects applications that rely on RaTeX for math rendering, especially those processing user-provided LaTeX content.

Mitigation Strategies

Upgrade RaTeX to version 0.1.11 or later immediately. If upgrading is not possible, disable or restrict access to RaTeX services handling untrusted LaTeX input until patched.

Hi! I’m here to help you understand CVE-2026-53530. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70