High severity · published Oct 28, 2026
CVE-2026-118694
python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations
New
7.5
CVSS
–
EPSS
No
On KEV
Description
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
python-markdown2 · trentm
through 2.5.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118694
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118694
github.com
https://github.com/trentm/python-markdown2
github.com
https://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L1478-L1492
github.com
https://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L3029
github.com
https://github.com/trentm/python-markdown2/issues/750
github.com
https://github.com/trentm/python-markdown2/pull/751
www.vulncheck.com
https://www.vulncheck.com/advisories/python-markdown2-through-2.5.5-denial-of-service-via-unclosed-inline-link-destinations