CVE-2026-26047

A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits could allow specially crafted formulas to consume excessive server resources. An authenticated user could abuse this behavior to degrade performance or cause service interruption.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-26047	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2440905	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::

History

26 Feb 2026, 19:45

Type	Values Removed	Values Added
CWE		CWE-770
Summary		(es) Se ha identificado una vulnerabilidad de denegación de servicio en el editor de fórmulas TeX de Moodle. Al renderizar contenido TeX usando mimetex, si los límites de tiempo de ejecución son insuficientes, podrían permitir que fórmulas especialmente diseñadas consuman excesivos recursos del servidor. Un usuario autenticado podría abusar de este comportamiento para degradar el rendimiento o causar interrupción del servicio.
References	~~() https://access.redhat.com/security/cve/CVE-2026-26047 -~~	() https://access.redhat.com/security/cve/CVE-2026-26047 - Third Party Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2440905 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2440905 - Third Party Advisory
First Time		Moodle moodle Moodle
CPE		cpe:2.3:a:moodle:moodle::::::::

21 Feb 2026, 06:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-21 06:17

Updated : 2026-02-26 19:45

NVD link : CVE-2026-26047

Mitre link : CVE-2026-26047

CVE.ORG link : CVE-2026-26047

JSON object : View

Products Affected

moodle

moodle

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-26047", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2026-02-21T06:17:00.377", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-26047", "tags": ["Third Party Advisory"], "source": "patrick@puiterwijk.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440905", "tags": ["Third Party Advisory"], "source": "patrick@puiterwijk.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A denial-of-service vulnerability was identified in Moodle\u2019s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits could allow specially crafted formulas to consume excessive server resources. An authenticated user could abuse this behavior to degrade performance or cause service interruption."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad de denegaci\u00f3n de servicio en el editor de f\u00f3rmulas TeX de Moodle. Al renderizar contenido TeX usando mimetex, si los l\u00edmites de tiempo de ejecuci\u00f3n son insuficientes, podr\u00edan permitir que f\u00f3rmulas especialmente dise\u00f1adas consuman excesivos recursos del servidor. Un usuario autenticado podr\u00eda abusar de este comportamiento para degradar el rendimiento o causar interrupci\u00f3n del servicio."}], "lastModified": "2026-02-26T19:45:29.417", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80B1995C-45EB-41E5-A497-D565964750A1", "versionEndExcluding": "4.5.9"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CDB0968-2E2B-4C2F-BF59-9479D1EEC287", "versionEndExcluding": "5.0.5", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36833D08-9C77-48B1-9240-7F326F5BB1CC", "versionEndExcluding": "5.1.2", "versionStartIncluding": "5.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "patrick@puiterwijk.org"}