CVE-2026-67422High· 7.5▾ Twilightpymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can parti…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.6%
Last analysed / modified upstream
0.6% → 0.7%
pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can submit Markdown to cause denial of service. The exposure is concrete for web applications that render user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build untrusted Markdown. The issue has been fixed in version 11.0.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
pymdown-extensions < 11.0.1Patched in:
pymdown-extensions 11.0.1Source: https://osv.dev/vulnerability/GHSA-gm37-52c6-37mw
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73643High· 7.5js-yaml is a JavaScript YAML parser and dumper
CVE-2026-81725Medium· 5.9nltk: NLTK: Regular Expression Denial of Service via malformed TEI blocks (CVE-2026-81725)
CVE-2026-80205High· 7.5nltk: NLTK: Denial of Service via unvalidated regular expressions (CVE-2026-80205)
CVE-2026-55574High· 7.5vllm: vLLM: Denial of Service via adversarial regular expression in structured outputs API (CVE-2026-55574)
CVE-2026-49477High· 7.5soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings (CVE-2026-49477)
CVE-2026-88932Medium· 5.3multer is a Node.js middleware for handling multipart/form-data uploads