CVE-2026-111766

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111766", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-16T17:52:09.082Z", "datePublished": "2026-10-19T19:47:46.488Z", "dateUpdated": "2026-10-26T17:37:11.818Z"}, "containers": {"cna": {"title": "markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-407", "lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"}, {"name": "https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79", "tags": ["x_refsource_MISC"], "url": "https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79"}, {"name": "https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503", "tags": ["x_refsource_MISC"], "url": "https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503"}, {"name": "https://github.com/markdown-it/markdown-it/releases/tag/14.3.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/markdown-it/markdown-it/releases/tag/14.3.3"}, {"name": "https://github.com/markdown-it/markdown-it/releases/tag/15.0.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"}], "affected": [{"vendor": "markdown-it", "product": "markdown-it", "versions": [{"version": ">= 15.0.0, < 15.0.3", "status": "affected"}, {"version": "< 14.3.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-19T19:47:46.488Z"}, "descriptions": [{"lang": "en", "value": "markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3."}], "source": {"advisory": "GHSA-vfgh-jcmw-g37q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-111766", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T17:29:30.362422Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T17:37:11.818Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-111766", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T17:29:30.362422Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T17:36:00.743Z"}}], "cna": {"title": "markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled", "source": {"advisory": "GHSA-vfgh-jcmw-g37q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "markdown-it", "product": "markdown-it", "versions": [{"status": "affected", "version": ">= 15.0.0, < 15.0.3"}, {"status": "affected", "version": "< 14.3.3"}]}], "references": [{"url": "https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q", "name": "https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79", "name": "https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503", "name": "https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/markdown-it/markdown-it/releases/tag/14.3.3", "name": "https://github.com/markdown-it/markdown-it/releases/tag/14.3.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/markdown-it/markdown-it/releases/tag/15.0.3", "name": "https://github.com/markdown-it/markdown-it/releases/tag/15.0.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-19T19:47:46.488Z"}}}, "cveMetadata": {"cveId": "CVE-2026-111766", "state": "PUBLISHED", "dateUpdated": "2026-10-26T17:37:11.818Z", "dateReserved": "2026-10-16T17:52:09.082Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-19T19:47:46.488Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "markdown-it", "vendor": "markdown-it", "versions": [{"status": "affected", "version": ">= 15.0.0, < 15.0.3"}, {"status": "affected", "version": "< 14.3.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3."}], "id": "CVE-2026-111766", "lastModified": "2026-10-26T18:17:36.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111766", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-26T17:29:30.362422Z", "version": "2.0.3"}}]}, "published": "2026-10-19T20:17:52.247", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79"}, {"source": "security-advisories@github.com", "url": "https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503"}, {"source": "security-advisories@github.com", "url": "https://github.com/markdown-it/markdown-it/releases/tag/14.3.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-407"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "markdown-it: markdown-it: Denial of Service via repeated unterminated inline HTML constructs", "id": "2555815", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555815"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-1333", "details": ["A flaw was found in markdown-it. When HTML parsing is enabled, a remote attacker can cause a Denial of Service (DoS) by supplying specially crafted Markdown input containing repeated unterminated inline HTML constructs. The parser repeatedly scans overlapping input while searching for closing tags, leading to quadratic processing time that can block the event loop and render the application or browser thread unresponsive."], "name": "CVE-2026-111766", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Fix deferred", "package_name": "rh-podman-desktop", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "thrift", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "libgit2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libgit2_1.9", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-feature-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-10-19T19:47:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-111766\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111766\nhttps://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79\nhttps://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503\nhttps://github.com/markdown-it/markdown-it/releases/tag/14.3.3\nhttps://github.com/markdown-it/markdown-it/releases/tag/15.0.3\nhttps://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[15.0.0,15.0.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,14.3.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "markdown-it", "source": "cna", "vendor": "markdown-it"}, "product": "markdown-it", "vendor": "markdown-it"}], "created": "2026-10-19T21:30:03.741087+00:00", "updated": "2026-10-20T07:15:11.306955+00:00", "vendors": ["markdown-it", "markdown-it$PRODUCT$markdown-it"]}