low
advisory
python-markdown2: Denial of Service via unclosed inline links (CVE-2026-118694)
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations.
CVE search metadata
CVE search record: CVE-2026-118694. Severity: high. CVSS: 7.5. KEV: no. Product: python-markdown2 (<= 2.5.5). Brief: python-markdown2: Denial of Service via unclosed inline links (CVE-2026-118694). Brief link: https://feed.craftedsignal.io/briefs/2026-10-python-markdown2-dos/
Triage facts
Revision 1- Applicability
- python-markdown2 (<= 2.5.5)
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 01:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
python-markdown2 through 2.5.5 contains a denial of service vulnerability. Attackers can submit repeated '[a](' or '![a](' sequences, causing the _find_balanced function to rescan the remaining document for each link and consume quadratic CPU time.