What is the CVSS score of EUVD-2026-54256?

EUVD-2026-54256 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Which versions of Python are affected by EUVD-2026-54256?

pymdown-extensions versions 11.0 and earlier contain a denial-of-service vulnerability affecting any web application rendering user-supplied Markdown, including those using the widely-deployed…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-54256?

Yes, a public proof-of-concept exploit is available for EUVD-2026-54256. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate EUVD-2026-54256?

Within 24 hours: audit your application dependencies to identify any use of pymdown-extensions version 11.0 or earlier, including indirect dependencies through pymdownx.extra. Within 7 days: if Markdown rendering is essential, implement input validation to reject payloads triggering catastrophic backtracking patterns, deploy rate limiting on rendering operations, and consider disabling the affected inline processors (betterem, caret, tilde, magiclink) if not critical to functionality. Within 30 days: monitor the pymdown-extensions GitHub security advisory (GHSA-gm37-52c6-37mw) for vendor patch releases; when a patch becomes available, evaluate compatibility, plan staged upgrade, and test before production deployment.

Python EUVD-2026-54256

| CVE-2026-67422 HIGH

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-08-06 security-advisories@github.com

GHSA-gm37-52c6-37mw

Denial Of Service Python

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Aug 06, 2026 - 23:03 EUVD

Source Code Evidence Fetched

Aug 06, 2026 - 22:49 vuln.today

Analysis Generated

Aug 06, 2026 - 22:49 vuln.today

CVE Published

Aug 06, 2026 - 22:18 cve.org

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on pymdown-extensions (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 11.0.1.

DescriptionCVE.org

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can submit Markdown to cause denial of service. The exposure is concrete for web applications that render user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build untrusted Markdown. The issue has been fixed in version 11.0.1.

AnalysisAI

Catastrophic regex backtracking in pymdown-extensions 11.0 and earlier enables unauthenticated remote denial of service via crafted Markdown input under 50 bytes. The betterem, caret, tilde, and magiclink inline processors use ambiguous alternation groups that allow exponentially many partition paths for delimiter runs, causing the Python regex engine to spin without bound. Any web application rendering user-supplied Markdown with these extensions — including those using the pymdownx.extra bundle — is exposed to rendering-thread freeze with no authentication required, as confirmed by the CVSS PR:N/UI:N vector and GitHub security advisory GHSA-gm37-52c6-37mw. No public exploit or CISA KEV listing has been identified at time of analysis.