CVE-2026-118694: falha de alta gravidade em trentm python-markdown2
python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.5%
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
trentm · python-markdown2Referências
https://github.com/trentm/python-markdown2https://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L1478-L1492https://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L3029https://github.com/trentm/python-markdown2/issues/750https://github.com/trentm/python-markdown2/pull/751https://www.vulncheck.com/advisories/python-markdown2-through-2.5.5-denial-of-service-via-unclosed-inline-link-destinations