A memory management flaw in the native rendering code of mdex and mdex_native leads to an unbounded leak of OS‑level memory each time a document containing escaped‑tag nodes is rendered. The bug causes the process to permanently allocate memory that is never reclaimed, eventually exhausting available RAM and crashing the BEAM runtime. This flaw is a classic instance of CWE‑401 (Memory Leak). The impact is a denial of service that can bring down all applications running in the same Erlang/BEAM instance.

The vulnerability is present in leandrocp's mdex package from version 0.11.0 up to (but not including) 0.12.3, and in the mdex_native package from version 0.1.0 up to (but not including) 0.2.3. Any application that uses these libraries to render documents derived from user input is affected.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score is not available and the CVE is not listed in CISA's KEV catalog. Based on the description, it is inferred that the likely attack vector is an attacker supplying a crafted MDEx document containing escaped‑tag nodes to the public MDEx.to_html/1 API or any other rendering endpoint that accepts user data. An attacker only needs to supply a crafted MDEx document that includes escaped‑tag nodes, which is possible through the public MDEx.to_html/1 API or any other rendering endpoint that accepts user data. Because there is no size or rate limiting on the rendering path, repeated or large documents can cause the process to consume memory without bound, leading to a crash. The attack can be performed remotely if the rendering service is exposed to external clients, or locally in any environment where the application processes untrusted content.