GitHub Advisoryadvisory · Packagist

GHSA-cg8j-5cr2-568q Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits

MEDIUM Published 2026-02-21 Modified 2026-02-27 Official page ↗
Aliases
CVE-2026-26047
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770
Reviewed
2026-02-25

Affected packages

• Packagist moodle/moodle: >= 5.1.0-beta, < 5.1.2 → fixed in 5.1.2 • Packagist moodle/moodle: >= 5.0.0-beta, < 5.0.5 → fixed in 5.0.5 • Packagist moodle/moodle: < 4.5.9 → fixed in 4.5.9

Description

A Denial of Service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits could allow specially crafted formulas to consume excessive server resources. An authenticated user could abuse this behavior to degrade performance or cause service interruption.

Related

Alias · CVE (1)

  • CVE-2026-26047 A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References