CVE-2026-118694
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Oct 28, 2026
CISA due date
—
The record
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62160 Daptin is a GraphQL/JSON-API headless CMS. CWE-407
- CVE-2026-87768 DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop… CWE-407
- CVE-2026-119196 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-119194 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-119195 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-119197 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2019-25781 Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in… CWE-407
- CVE-2026-118664 decode-uri-component provides a more robust alternative to decodeURIComponent. CWE-407