CVE-2019-25781
Awaiting Analysis Awaiting Analysis - Queue

Python-Markdown Inline Link Parsing CPU Exhaustion

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: VulnCheck

Description
Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2019-25781
EUVD
EUVD-2019-20211

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Python-Markdown Markdown 3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in Python-Markdown versions 3.0 through 3.11.2. It involves inefficient link bracket parsing where attackers submit short Markdown with repeated unmatched [ or ![ characters. This triggers quadratic time complexity scans in functions like LinkInlineProcessor.getText() and getLink(), exhausting CPU resources for minutes.

Detection Guidance

To detect this vulnerability, monitor for excessive CPU usage when processing Markdown content. Check for repeated unmatched [ or ![ characters in input files or web requests. Use tools like top or htop to identify processes consuming high CPU for extended periods during Markdown parsing.

Impact Analysis

The vulnerability can cause severe performance degradation or complete denial of service for applications using affected Python-Markdown versions. Attackers can send malicious Markdown input to crash servers or degrade service quality by consuming excessive CPU resources.

Mitigation Strategies

Upgrade Python-Markdown to a patched version beyond 3.11.2. Implement input sanitization to limit Markdown size and block excessive bracket characters. Use regex to filter malicious patterns like repeated [ or ![ sequences before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2019-25781. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart