The vulnerability is an unbounded memory allocation in the native highlight_lines parser of mdex, where a user‑controlled inclusive line range in a fenced code block’s info string is eagerly expanded into a vector without any size restriction. The parser allocates roughly eight bytes per line and performs a linear membership test for each line, resulting in quadratic rendering cost for large ranges. An attacker can cause the BEAM VM to exhaust memory or consume excessive CPU by submitting a highlight_lines range such as 1‑2000000000, leading to denial of service.

The issue affects the Open‑Source mdex library version 0.11.0 up to 0.12.2 and the separate mdex_native package versions 0.1.0 up to 0.2.2. Both repositories are hosted under the leandrocp GitHub organization, and any application that uses either of these crates to render Markdown (e.g., comments, chat, wiki pages) is at risk.

The CVSS score of 6.9 denotes moderate severity, and the EPSS is not available, but the lack of authentication requirements and the straightforward exploitation via crafted Markdown render endpoints give it a non‑negligible likelihood. The vulnerability is not listed in CISA KEV yet, but in high‑traffic deployments a single unauthenticated user could flood memory and bring down the rendering process for all users. Attackers can fully control the range size in the highlight_lines decorator, so no additional conditions are needed beyond the ability to submit Markdown.