Denial of Service Vulnerability in Pymdown Extensions for Python Markdown

CVE-2026-67422

What is CVE-2026-67422?

Pymdown Extensions, a collection of enhancements for the Python Markdown library, is vulnerable to a Denial of Service attack due to improper handling of regular expressions in the caret, tilde, betterem, and magiclink processors. Versions up to and including 11.0 can lead to unbounded CPU usage when processing a crafted Markdown line under 50 bytes. The catastrophic backtracking caused by the regexes enables an unauthenticated remote attacker to exploit web applications that render user-uploaded Markdown. This exposure is significant for applications such as comments sections, wikis, and CI systems that use untrusted Markdown input. The issue has been rectified in version 11.0.1.

References