UBUNTU-CVE-2026-118694: Ubuntu/python-markdown2 vulnerability
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing findbalanced to rescan the remaining document for each link and consume quadratic CPU time.
Affected Software
Event History
Frequently Asked Questions
What input must an attacker be able to provide to trigger the issue?
An attacker needs to be able to submit Markdown that the application processes with python-markdown2. Repeated unclosed inline link patterns such as "[a](" or "![a](" trigger repeated rescanning and quadratic CPU consumption.
What is the practical impact?
The issue is a denial of service through CPU exhaustion. Processing specially crafted Markdown can consume quadratic CPU time, potentially making the affected application slow or unavailable while the input is handled.
Which versions are affected?
python-markdown2 versions through 2.5.5 are affected according to the available information.