low
advisory
Python-Markdown: Algorithmic complexity vulnerability (CVE-2019-25781)
Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows CPU exhaustion.
CVE search metadata
CVE search record: CVE-2019-25781. Severity: high. CVSS: 7.5. KEV: no. Product: Python-Markdown 3.0 through 3.11.2 (3.0-3.11.2). Brief: Python-Markdown: Algorithmic complexity vulnerability (CVE-2019-25781). Brief link: https://feed.craftedsignal.io/briefs/2026-10-python-markdown-cve-2019-25781/
Triage facts
Revision 1- Applicability
- Python-Markdown 3.0 through 3.11.2 (3.0-3.11.2)
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 05:20 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Python-Markdown versions 3.0 through 3.11.2 contain an algorithmic complexity vulnerability in inline link parsing. Remote attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.