CVE-2026-118694

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118694", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-28T17:31:29.498Z", "datePublished": "2026-10-28T21:11:20.814Z", "dateUpdated": "2026-10-29T17:22:18.429Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-28T21:11:20.814Z"}, "datePublic": "2026-10-28T00:00:00.000Z", "title": "python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations", "descriptions": [{"lang": "en", "value": "python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Inefficient Algorithmic Complexity", "cweId": "CWE-407", "type": "CWE"}]}], "affected": [{"vendor": "trentm", "product": "python-markdown2", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/markdown2", "versions": [{"version": "0", "lessThanOrEqual": "2.5.5", "status": "affected", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:python-markdown2_project:python-markdown2:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.5.5"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/trentm/python-markdown2/issues/750", "tags": ["issue-tracking"], "name": "GitHub Issue #750"}, {"url": "https://github.com/trentm/python-markdown2", "tags": ["product"]}, {"url": "https://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L1478-L1492", "tags": ["technical-description"]}, {"url": "https://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L3029", "tags": ["technical-description"]}, {"url": "https://github.com/trentm/python-markdown2/pull/751", "tags": ["patch", "issue-tracking"]}, {"name": "VulnCheck Advisory: python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/python-markdown2-through-2.5.5-denial-of-service-via-unclosed-inline-link-destinations"}], "credits": [{"lang": "en", "value": "Muhammadyusuf Dilmurodov (agrresore)", "type": "finder"}, {"lang": "en", "value": "ParamTanna", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T15:43:38.163754Z", "id": "CVE-2026-118694", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T17:22:18.429Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118694", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T15:43:38.163754Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T15:43:39.290Z"}}], "cna": {"title": "python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations", "credits": [{"lang": "en", "type": "finder", "value": "Muhammadyusuf Dilmurodov (agrresore)"}, {"lang": "en", "type": "finder", "value": "ParamTanna"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "trentm", "product": "python-markdown2", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.5.5"}], "packageURL": "pkg:pypi/markdown2", "defaultStatus": "unaffected"}], "datePublic": "2026-10-28T00:00:00.000Z", "references": [{"url": "https://github.com/trentm/python-markdown2/issues/750", "name": "GitHub Issue #750", "tags": ["issue-tracking"]}, {"url": "https://github.com/trentm/python-markdown2", "tags": ["product"]}, {"url": "https://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L1478-L1492", "tags": ["technical-description"]}, {"url": "https://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L3029", "tags": ["technical-description"]}, {"url": "https://github.com/trentm/python-markdown2/pull/751", "tags": ["patch", "issue-tracking"]}, {"url": "https://www.vulncheck.com/advisories/python-markdown2-through-2.5.5-denial-of-service-via-unclosed-inline-link-destinations", "name": "VulnCheck Advisory: python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "Inefficient Algorithmic Complexity"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:python-markdown2_project:python-markdown2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.5.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-28T21:11:20.814Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118694", "state": "PUBLISHED", "dateUpdated": "2026-10-29T17:22:18.429Z", "dateReserved": "2026-10-28T17:31:29.498Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-28T21:11:20.814Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/markdown2", "product": "python-markdown2", "vendor": "trentm", "versions": [{"lessThanOrEqual": "2.5.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time."}], "id": "CVE-2026-118694", "lastModified": "2026-10-29T18:17:28.427", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118694", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T15:43:38.163754Z", "version": "2.0.3"}}]}, "published": "2026-10-28T22:17:13.700", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/trentm/python-markdown2"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L1478-L1492"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L3029"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/trentm/python-markdown2/issues/750"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/trentm/python-markdown2/pull/751"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/python-markdown2-through-2.5.5-denial-of-service-via-unclosed-inline-link-destinations"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "markdown2: markdown2: Denial of Service via unclosed inline link destinations", "id": "2563209", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563209"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-606", "details": ["python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time.", "A flaw was found in markdown2. A remote attacker can cause a Denial of Service (DoS) by submitting specially crafted Markdown content containing repeated unclosed inline link sequences. Processing these malformed links causes the parser to repeatedly rescan the text, exhausting CPU resources and making the service unresponsive."], "name": "CVE-2026-118694", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-olm-catalogd-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T21:11:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118694\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118694\nhttps://github.com/trentm/python-markdown2\nhttps://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L1478-L1492\nhttps://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L3029\nhttps://github.com/trentm/python-markdown2/issues/750\nhttps://github.com/trentm/python-markdown2/pull/751\nhttps://www.vulncheck.com/advisories/python-markdown2-through-2.5.5-denial-of-service-via-unclosed-inline-link-destinations"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.5.5]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "python-markdown2", "source": "cna", "vendor": "trentm"}, "product": "python-markdown2", "vendor": "python-markdown2_project"}], "created": "2026-10-28T22:30:12.255815+00:00", "updated": "2026-10-30T14:15:08.267270+00:00", "vendors": ["python-markdown2_project", "python-markdown2_project$PRODUCT$python-markdown2"]}