GHSA-297v-g8mm-qj4h: High severity Eclipse Langium vulnerability
Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected.
Affected Software
Event History
Frequently Asked Questions
Which Langium-based applications are affected?
Only languages that opt in to IndentationAwareTokenBuilder and IndentationAwareLexer are affected. Applications using DefaultLexer and DefaultTokenBuilder are unaffected.
What must an attacker provide to trigger the denial of service?
An attacker needs to cause the application to tokenize a crafted document with indentation changes on most lines. A document of a few hundred kilobytes can block the Node.js event loop for tens of seconds.
What is the impact in a shared Node.js process?
Because tokenization runs synchronously, the blocked event loop can deny service to every user handled by the same Node.js process.