CVE-2026-124683
Eclipse Langium Algorithmic Complexity Denial of Service
Description
Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected.
INFO
Published Date :
Nov. 9, 2026, 4:02 p.m.
Last Modified :
Nov. 9, 2026, 4:02 p.m.
Remotely Exploit :
Yes !
Source :
eclipse
Affected Products
The following products are affected by CVE-2026-124683
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | HIGH | e51fbebd-6053-4e49-959f-1b94eeb69a2c |
Solution
- Update to Langium version 4.4.1 or later.
- Ensure IndentationAwareTokenBuilder is not used if vulnerable.
- Avoid processing large documents with frequent indentation changes.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-124683 vulnerability anywhere in the article.