CVE-2019-25781
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Oct 29, 2026
CISA due date
—
The record
Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62160 Daptin is a GraphQL/JSON-API headless CMS. CWE-407
- CVE-2026-87768 DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop… CWE-407
- CVE-2026-119196 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-119194 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-119195 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-119197 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-118694 python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows… CWE-407
- CVE-2026-118664 decode-uri-component provides a more robust alternative to decodeURIComponent. CWE-407