Denial of Service Vulnerability in python-markdown2 by Trent Mick
CVE-2026-118694

8.7HIGH

Key Information:

Vendor

Trentm

Status
Python-markdown2
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118694?

The python-markdown2 library, specifically version 2.5.5, is susceptible to a denial of service attack. This vulnerability arises when remote users exploit unclosed inline link destinations in Markdown syntax. By sending repeated sequences of links formatted as '[a](' or '![a](', attackers induce the _find_balanced function to rescan the document multiple times for each unclosed link. This results in significant CPU time consumption, leading to potential service interruptions. For more information, please refer to the GitHub Issue #750 or the VulnCheck Advisory.

Affected Version(s)

python-markdown2 0 <= 2.5.5

References

https://github.com/trentm/python-markdown2/issues/750
issue-tracking
https://github.com/trentm/python-markdown2
product
https://github.com/trentm/python-markdown2/blob/2.5.5/lib...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammadyusuf Dilmurodov (agrresore)
ParamTanna
.