Algorithmic Complexity Vulnerability in Python-Markdown by Python Software Foundation
CVE-2019-25781

8.7HIGH

Key Information:

Vendor

Python-markdown

Status
Markdown
Vendor
CVE Published:
29 October 2026

What is CVE-2019-25781?

Python-Markdown versions 3.0 through 3.11.2 include a vulnerability in the inline link parsing mechanism. This flaw is triggered by maliciously crafted Markdown input containing excessive unmatched brackets. Attackers can exploit this weakness, leading to excessive CPU utilization as the system enters a prolonged processing loop, which can compromise performance and result in denial of service. It's essential for users and developers to be aware of this vulnerability and implement appropriate mitigations or upgrades.

Affected Version(s)

Markdown 3.0 <= 3.11.2

References

https://github.com/Python-Markdown/markdown/issues/798
issue-tracking
https://github.com/Python-Markdown/markdown
product
https://github.com/Python-Markdown/markdown/issues/1654
issue-tracking

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anders Kaseorg
Muhammadyusuf Dilmurodov (agrresore)
.