Live › vulnerability › CVE-2026-118694
Go to dashboardpython-markdown2 through 2.5.5 rescans the rest of the document for each unclosed inline link, so crafted Markdown with repeated '[a](' or '![a](' takes quadratic CPU time. A remote user who can submit Markdown can make the process spend the CPU and stall other requests.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Applications that pass untrusted user Markdown to python-markdown2 with the default parser are exposed, because any remote submitter can trigger the slow path. Services that render only trusted or internal Markdown, or that do not use markdown2, can skip it.
No product ranges from the sources yet.
pip show markdown2 or python -c "import markdown2; print(markdown2.__version__)" and compare against 2.5.52.5.5 (exact fixed version unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time.
This page as .md · .json · in your agent: get_signal("CVE-2026-118694")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.