CVE-2026-67422

Received Received - Intake

ReDoS in pymdown-extensions Markdown Parser

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can submit Markdown to cause denial of service. The exposure is concrete for web applications that render user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build untrusted Markdown. The issue has been fixed in version 11.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-67422

Affected Vendors & Products

Vendor	Product	Version / Range
pycqa	pymdown-extensions	to 11.0 (inc)
pycqa	pymdown-extensions	11.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

This vulnerability affects pymdown-extensions, a Python Markdown library extension. It involves four inline processors (caret, tilde, betterem, magiclink) that use regex patterns prone to catastrophic backtracking. Malicious input can cause unbounded CPU usage, leading to denial of service.

Detection Guidance

This vulnerability is specific to the pymdown-extensions library and can be detected by checking the installed version of the package. Run 'pip show pymdown-extensions' to see the version. If it is less than or equal to 11.0, the system is vulnerable.

Impact Analysis

If you use pymdown-extensions in a web app that renders user-supplied Markdown (e.g., comments, wikis), an attacker could submit crafted input to crash the server by consuming excessive CPU resources. This disrupts service availability.

Mitigation Strategies

Upgrade pymdown-extensions to version 11.0.1 or later using 'pip install --upgrade pymdown-extensions'. If immediate upgrade is not possible, disable the vulnerable inline processors (caret, tilde, betterem, magiclink) in your Markdown configuration.

Hi! I’m here to help you understand CVE-2026-67422. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70