CVE-2026-118694
python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations
trentm python-markdown2Runtimes & languages
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time.
Text from CVE List
Affected versions 1
- python-markdown2affected: all versions through 2.5.5CVE List
References 6
- github.com/trentm/python-markdown2/pull/751Fixvia CVE List
- vulncheck.com/advisories/python-markdown2-through-2.5.5-denial-of-service-via-unclosed-inline-link-destinationsAdvisoryvia CVE List
- github.com/trentm/python-markdown2/issues/750Referencevia CVE List
- github.com/trentm/python-markdown2Referencevia CVE List
- github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L1478-L1492Referencevia CVE List
- github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L3029Referencevia CVE List