CVE-2026-1246838.7HighCWE-407

CVE-2026-124683: Eclipse Foundation Eclipse Langium vulnerability

Eclipse Foundation · Eclipse Langium

Affected: Eclipse Foundation Eclipse Langium · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.5%probability of exploitation in the next 30 days

43rd percentile

050100

Higher than 43% of scored CVEs

8.7HighCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Eclipse Foundation · Eclipse Langiumfrom 3.2.0 up to and including 4.4.0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Inefficient Algorithmic Complexity · Denial of Service
Vendor: Eclipse Foundation
Published: November 2026
Band: Unlikely (under 1%), November 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-124683 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.