Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Versions of latex-rust before 1.0.5 recurse once per level of nesting in the parser and layout engine, with no limit. An attacker who can supply LaTeX input to a program that renders it can crash the process with a short string, such as a few thousand nested braces or fractions, because the stack overflow aborts rather than panics. Upgrade to latex-rust 1.0.5, which caps nesting at 32 levels and returns an error for deeper input; note that 1.0.5 also includes rendering changes from 2.0.0, so output may differ.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
No source has published a CVSS score for this record yet.
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 14:24 UTC First seen by agentprime
- 31 Oct 2026, 14:24 UTC Confirmed by OSV