Live › vulnerability › CVE-2019-25781
Python-Markdown versions 3.0 through 3.11.2 parse inline links with a quadratic-time routine, so repeated unmatched brackets take minutes of CPU. A remote attacker can tie up worker processes with a short Markdown message, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Any application that passes user-supplied Markdown to Python-Markdown 3.0 through 3.11.2 is exposed, because the attacker only needs to submit text the parser will read. Services that render only trusted, internal Markdown are less exposed. unknown whether the sources list any further configuration that is required.
No product ranges from the sources yet.
pip show markdown or python -c "import markdown; print(markdown.__version__)" and check whether the version is between 3.0 and 3.11.2markdown to find pinned versions3.11.2 (the sources do not name the exact fixed release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.
This page as .md · .json · in your agent: get_signal("CVE-2019-25781")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.