EUVD-2026-112495
GHSA-rgrp-3mvm-5g9j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Markdown-rendering endpoint
-
DeliverySubmit payload of repeated unclosed '[a](' openers
-
Exploit_find_balanced rescans document per link
-
ExecutionQuadratic CPU consumption on worker
-
ImpactService degradation / denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | The application must accept attacker-controlled Markdown and render it through python-markdown2 at or below version 2.5.5; any such code path (web comment/post rendering, API-driven Markdown-to-HTML conversion, chat or wiki rendering) is exploitable because no authentication (PR:N) or user interaction (UI:N) is required and default configuration is sufficient. There is no special markdown2 feature flag needed - standard link/image parsing is the vulnerable path. The practical limits on exploitation are scope rather than difficulty: the attacker needs a reachable surface that passes untrusted input to markdown2, and the impact is confined to CPU/availability exhaustion of the processing worker (VC:N/VI:N) with no data read or modification. |
| Impact | This is a genuine availability risk but not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated trigger with no attack requirements, and the only impact is availability (VA:H; VC:N/VI:N) - consistent with CWE-407 algorithmic complexity: repeated '[a](' or ', and the regression test added in the fix (test/tm-cases/unclosed_link_parens.html), so the barrier to reproducing it is effectively zero. Net: a legitimate priority for any service that renders untrusted Markdown with markdown2, but the ceiling is resource exhaustion - no confidentiality or integrity exposure - so it should be patched promptly rather than treated as a breach-class event. |
| Exploit ScenarioDerived | An attacker submits a Markdown document containing a long run of unclosed inline link openers (e.g. thousands of repeated '[a](' or ' to any endpoint that renders user-supplied Markdown with python-markdown2 - a comment field, issue tracker, chat, or API. Each opener causes _find_balanced to rescan the rest of the document, so a modestly sized input drives CPU time up quadratically and ties up the worker. The exact triggering input is public (GitHub issue #750 and the fix's regression test), so no novel exploit development is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Quadratic CPU exhaustion in python-markdown2 (through 2.5.5) lets remote attackers burn processing time by submitting Markdown containing repeated unclosed inline link or image destinations such as '[a](' or ' is exposed because the standard inline anchor/image parser is the vulnerable path. Impact is confined to availability of the rendering worker (VC:N/VI:N/VA:H, assessed CVSS:3.1 8.7-equivalent severity); no public exploit code was identified at time of analysis, and the issue is not in CISA KEV. An upstream fix exists as a pull request rather than a confirmed tagged release.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the fix is in pull request https://github.com/trentm/python-markdown2/pull/751, which caches the last close-delimiter position in _find_balanced and short-circuits parse_inline_anchor_or_image when the destination paren never closes, and it adds a regression test fixture. Because no tagged release version is stated in the available data, confirm the fixed tag on https://github.com/trentm/python-markdown2 before pinning, and treat patch availability as vendor-reported per the advisory and issue #750. Until an upgraded release is deployed, the practical interim control is to bound the cost of the vulnerable path: cap accepted Markdown document length and reject or truncate pathological inputs before they reach markdown2, and rate-limit or time-box Markdown rendering workers so a single request cannot monopolize a process. Both have trade-offs - length caps can reject legitimate large documents and must be tuned per use case, and worker timeouts will surface as render failures rather than clean rejections. Restricting Markdown rendering to trusted or authenticated content producers removes the remote attack surface entirely but changes the product's functionality; unchanged worker capacity alone does not mitigate the quadratic growth.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
python-markdown2 is a pure-Python Markdown-to-HTML converter used as a library across web frameworks, wikis, comment systems and API pipelines. The flaw is CWE-407 (inefficient algorithm with disproportionately costly control flow): the inline link scanner calls _find_balanced(text, start, '(', ')') for each candidate '[a](' or '' (returning len(text)), and it adds an early return in parse_inline_anchor_or_image when text[end_idx - 1] != ')', since the inline link title regex ends in \)$ and cannot match when the destination's opening paren never closed. The PR also ships a regression fixture (test/tm-cases/unclosed_link_parens) built from long runs of unclosed '[a](' and '; impact is pure CPU exhaustion, so A:H with C:N/I:N and unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or ' allows unauthenticated attackers to cause CPU exhaustion by submitting specially crafted Markdown, potentially disrupting services that render user-generated content. This impacts any application using the library for Markdown rendering, including comment systems, wikis, and chat platforms, and could lead to service outages and degraded user experience.
No vendor-released patch identified at time of analysis; interim mitigations include rate limiting, input size restrictions, and resource quotas on Markdown processing workers.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB