RaTeX's parser uses mutual recursion without any depth limit when parsing nested LaTeX expressions, including groups and constructs like '\left' and '\sqrt{'. The recursion consumes one native stack frame per nesting level, and no recursion depth guard is implemented. Consequently, deeply nested inputs cause the Rust process to overflow its stack and abort with SIGABRT, resulting in an unrecoverable denial of service. This issue is exploitable by unauthenticated attackers via a single crafted LaTeX string. The vulnerability affects ratex-parser versions before 0.1.11.

A single crafted input with deeply nested LaTeX constructs can cause the entire ratex-parser process to crash due to stack overflow. In server-side math rendering services, this leads to a reliable, unauthenticated denial of service. On environments with smaller thread stacks, such as async runtime threads with 512 KB stacks, even smaller inputs can trigger the crash, increasing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted LaTeX input with deeply nested groups or constructs in ratex-parser. Consider limiting input size or nesting depth externally as a temporary mitigation.