Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity flaw (CWE-407) in the opt‑in IndentationAwareTokenBuilder and IndentationAwareLexer. When generating DEDENT tokens, a token builder recomputes line numbers by re‑scanning the entire preceding document text. A document whose indentation changes on most lines then requires quadratic time to tokenize, which causes the synchronous tokenization process to block the Node.js event loop for extended periods. The result is a denial‑of‑service condition that disables all users served by the same process.

Eclipse Foundation’s Eclipse Langium 3.2.0 through 4.4.0 are affected. Applications built with the DefaultLexer and DefaultTokenBuilder remain unaffected.

The CVSS score of 8.7 reflects a high‑severity risk. The EPSS score is not available, and the vulnerability is not yet catalogued in CISA’s KEV list. Attackers can craft a document containing extensive indentation changes and supply it to the language server or an application that uses the affected tokenizers; the synchronous tokenization would then block the event loop, resulting in a denial of service for all users served by the process. The exact external attack vector is not documented, but a remote or local user with write access to the document source could trigger the flaw, as inferred from the description.