---
id: CVE-2026-67422
title: >-
  pymdown-extensions is a collection of extensions for the Python Markdown
  library
summary: >-
  pymdown-extensions is a collection of extensions for the Python Markdown
  library. In versions up to and including 11.0, four inline processors (caret,
  tilde, betterem, and magiclink) use regular expressions whose content groups
  can parti…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-1333
vendor: Red Hat
product: Red Hat Developer Hub
affected:
  - developer_hub
  - ansible_automation_platform 2.2
patched:
  - ansible_automation_platform 2.2
published: '2026-08-06'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:41:33.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67422'
references:
  - url: >-
      https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b
    label: security-advisories@github.com
  - url: >-
      https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw
    label: security-advisories@github.com
  - url: >-
      https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67422.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-67422'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2512322'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-67422'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67422'
  - url: 'https://access.redhat.com/errata/RHSA-2026:66003'
  - url: 'https://github.com/facelessuser/pymdown-extensions'
  - url: 'https://access.redhat.com/errata/RHSA-2026:69248'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00608
epssPercentile: 0.46758
aliases:
  - GHSA-gm37-52c6-37mw
  - PYSEC-2026-3654
ecosystem: pip
ingestedAt: '2026-08-07T19:14:14.364Z'
---

## Overview

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can submit Markdown to cause denial of service. The exposure is concrete for web applications that render user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build untrusted Markdown. The issue has been fixed in version 11.0.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-67422)

Affected packages:

- `pymdown-extensions < 11.0.1`

Patched in:

- `pymdown-extensions 11.0.1`

Source: https://osv.dev/vulnerability/GHSA-gm37-52c6-37mw

## Vendor advisories

- **RHSA-2026:66003** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66003)
- **Red Hat VEX** · Important · affected: Red Hat Developer Hub · no fix planned: Red Hat Developer Hub · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67422.json)
- **RHSA-2026:69248** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69248)