CVE-2026-118694: python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing findbalanced to rescan the remaining document for each link and consume quadratic CPU time.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using python-markdown2 through version 2.5.5 are exposed when remote users can submit Markdown that the application processes. The issue can be triggered over the network without authentication or user interaction.
What input is required to trigger the issue?
An attacker can submit Markdown containing repeated unclosed inline link prefixes such as "[a](" or image-link prefixes such as "![a](". Processing this input causes repeated rescanning of the remaining document and quadratic CPU consumption.
What is the impact of a successful attack?
The vulnerability exhausts CPU while parsing crafted Markdown, which can make the affected application unavailable. The provided impact assessment indicates availability impact only, with no stated confidentiality or integrity impact.