An uncontrolled recursion flaw in leandrocp’s mdex allows an attacker to supply a Markdown document with extremely deep nesting of block quotes. The conversion between Elixir structs and Comrak’s AST uses two mutually recursive Rust functions without a depth check, so the native C stack is exhausted, causing an uncatchable SIGSEGV. This terminates the operating system process that hosts the BEAM virtual machine, bringing down every Erlang and Elixir process on the node. The flaw is a classic stack‑overflow denial of service, identified as CWE‑674, and it requires no authentication or special privileges.

The vulnerability affects the leandrocp mdex library from version 0.3.0 up to, but not including, 0.12.3, and the mdex_native package from 0.1.0 up to, but not including, 0.2.3. Versions newer than those contain the necessary recursion‑depth mitigation implemented in a recent commit.

With a CVSS score of 6.9 the risk is moderate, but because the crash is uncontainable within the BEAM and the attacker can supply Markdown through any exposed parse or render call, the practical danger is high. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet the lack of authentication and the severity of a full node crash make immediate attention warranted. An attacker who can inject Markdown – even via user‑generated content – can trigger an immediate and total denial of service.