Stack Overflow Vulnerability in latex-rust: Deeply Nested LaTeX Input
Summary
RUSTSEC-2026-0311: Stack overflow on deeply nested LaTeX input. Affects latex-rust versions >= 0.0.0-0, < 1.0.5. Fixed in 1.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
latex-rust is a Rust library designed for parsing and rendering LaTeX documents. It provides functionalities to convert LaTeX code into various formats such as PNG, SVG, and shapes. The library is widely used for applications that require LaTeX rendering capabilities. However, it is susceptible to a stack overflow vulnerability when processing deeply nested LaTeX input, which can lead to application crashes.
Vulnerability Detail
The vulnerability arises from the parser and layout engine in latex-rust, which recurse without a limit for each level of nesting in LaTeX input. This can lead to a stack overflow when processing deeply nested structures, such as fractions or braces, causing the application to abort unexpectedly. The issue is particularly severe as it can be triggered by untrusted input, allowing an attacker to crash the application with a short string. The vulnerability affects multiple functions within the library, including parsing and layout functions.
How To Fix
Minimum fixed version
1.0.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, avoid processing deeply nested LaTeX input. For example, limit the nesting of fractions or braces in your LaTeX code to prevent stack overflow. Here is an example of code that could cause a stack overflow:
let mut src = String::from("1");
for _ in 0..700 {
src = format!("\\frac{{1}}{{{src}}}");
}
let _ = latex_rust::parse(&src); // This will cause a stack overflow.
Conclusion
The stack overflow vulnerability in latex-rust poses a significant risk, especially when handling untrusted input. It is crucial to update to the latest version to mitigate this risk and ensure the stability of applications using this library.
See every vulnerability recorded for latex-rust →
FAQ
The main issue is a stack overflow vulnerability caused by deeply nested LaTeX input, which can lead to application crashes.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
Affected versions are those prior to 1.0.5. It is recommended to upgrade to version 1.0.5 or later.
If not fixed, an attacker could exploit this vulnerability to crash your application by providing deeply nested LaTeX input.
No, version 1.0.5 fixes the vulnerability without any API changes, making it a drop-in replacement for version 1.0.4.
