PT-2026-129197

CVE-2026-118694

Published

2026-10-28

Updated

2026-11-04

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions python-markdown2 versions prior to 2.5.5

Description A denial of service issue exists where remote users can exhaust CPU resources by submitting Markdown containing unclosed inline link destinations. By providing repeated '[a](' or '![a](' sequences, the find balanced() function rescans the remaining document for each link, resulting in quadratic CPU time consumption.

Recommendations Update to version 2.5.5 or later.

Exploitability

Exploit

Fix

Researchers

Muhammadyusuf Dilmurodov

Paramtanna

Vendors

Affected products

Weakness enumeration

CWE-407: Inefficient Algorithmic Complexity

Related identifiers