CVE-2026-26047: Moodle TeX Formula Editor Denial of Service Vulnerability
Summary
CVE-2026-26047: Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits. Affects moodle/moodle across 3 version ranges.
< 4.5.9
>= 5.0.0-beta, < 5.0.5
>= 5.1.0-beta, < 5.1.2
Fixed in 4.5.9, 5.0.5 or 5.1.2, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2026-26047 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. The TeX formula editor in Moodle allows users to render mathematical formulas using TeX syntax. However, it has been found to be vulnerable to Denial of Service (DoS) attacks due to insufficient execution time limits when processing complex formulas.
Vulnerability Detail
A Denial of Service vulnerability exists in Moodle's TeX formula editor, specifically when rendering TeX content with mimetex. The lack of execution time limits can allow specially crafted formulas to consume excessive server resources. This can lead to degraded performance or even service interruptions, especially if an authenticated user exploits this vulnerability to submit malicious formulas.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.5.94.5.9composer require moodle/moodle:4.5.9 -
>= 5.0.0-beta, < 5.0.55.0.5composer require moodle/moodle:5.0.5 -
>= 5.1.0-beta, < 5.1.25.1.2composer require moodle/moodle:5.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the execution time for PHP scripts in your server configuration. This can be done by adding the following line to your php.ini file: max_execution_time = 30. This will help mitigate the impact of the vulnerability until a proper update can be applied.
Conclusion
The identified Denial of Service vulnerability in Moodle's TeX formula editor poses a risk to server performance and availability. It is crucial for users to update their installations to the latest patched versions to mitigate this risk. Implementing temporary workarounds can provide additional protection until updates are applied.
See every vulnerability recorded for moodle/moodle →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
Any Moodle installation using the TeX formula editor versions prior to the patched versions mentioned is potentially affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, consider implementing the suggested workaround to limit execution time for PHP scripts.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just your composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
