CVE-2019-25781EUVD-2019-20211GHSA-4G9H-PV2V-FW83
Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Python-Markdown, a widely used Python library for converting Markdown text to HTML, is affected. A remote attacker can send short Markdown input with many unmatched brackets to consume excessive CPU, tying up processing workers for minutes and causing a denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Python-Markdown Markdown
From 3.0 · through 3.11.2