CVE-2026-26047
Medium · 6.5CVSS
6.5
EPSS
0.7%
Published
Feb 21, 2026
CISA due date
—
The record
A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits could allow specially crafted formulas to consume excessive server resources. An authenticated user could abuse this behavior to degrade performance or cause service interruption.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | moodle/moodle | 0 | 4.5.9 |
| Packagist | moodle/moodle | 5.0.0-beta | 5.0.5 |
| Packagist | moodle/moodle | 5.1.0-beta | 5.1.2 |
Related vulnerabilities
- GHSA-cg8j-5cr2-568q Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits Same vulnerability
- GHSA-ggxq-2mg9-8966 Moodle has a Remote Code Execution risk via file restore Also affects moodle/moodle
- CVE-2026-26045 A flaw was identified in Moodle’s backup restore functionality where specially crafted… Also affects moodle/moodle
- GHSA-5cx4-w4fh-fr57 Moodle Affected by Improper Restriction of Excessive Authentication Attempts Also affects moodle/moodle
- GHSA-8jrv-wx83-w3xj Moodle Inserts Sensitive Information Into Sent Data Also affects moodle/moodle
- GHSA-hcm6-q6pc-xfhm Moodle has an authorization logic flaw Also affects moodle/moodle
- GHSA-qv78-6gpp-hm68 Moodle Open Redirect vulnerability Also affects moodle/moodle
- GHSA-vwhw-vp9v-q9c9 Moodle vulnerable to Cross-site Scripting Also affects moodle/moodle