The vulnerability in leandrocp mdex involves unbounded memory allocation caused by the parse_highlight_lines function in the native Rust code. This function eagerly expands a user-supplied inclusive line range from a fenced code block's highlight_lines decorator into a vector, allocating memory proportional to the range size without any upper limit. An attacker can supply Markdown with a large highlight_lines range (e.g., "1-100000000") to force allocation of hundreds of megabytes or more, exhausting host memory and causing the BEAM process to abort, resulting in denial of service. The quadratic time complexity of the per-line membership test further degrades performance. The vulnerable code was originally part of mdex and later moved to mdex_native, where it remains unpatched. The affected versions are mdex 0.11.0 up to but not including 0.12.3, and mdex_native 0.1.0 up to but not including 0.2.3.

Successful exploitation allows an unauthenticated attacker to cause a denial of service by exhausting memory resources of the host running the mdex rendering process. This leads to the BEAM virtual machine aborting, disrupting service availability for all users relying on the rendering functionality. There is no indication of code execution or data corruption beyond denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects mdex versions from 0.11.0 before 0.12.3 and mdex_native from 0.1.0 before 0.2.3. Users should upgrade to versions 0.12.3 or later for mdex and 0.2.3 or later for mdex_native once available. Until patches are released, consider restricting or sanitizing user input that controls the highlight_lines range to prevent excessively large values.