Python-Markdown: Denial of service via unmatched brackets in link parsing
Summary
Python-Markdown versions 3.0 through 3.11.2 contain an algorithmic complexity flaw in inline link parsing. A remote attacker can submit short Markdown with many unmatched [ or ![ characters, which forces quadratic scans and can keep server workers busy for minutes. No privileges or user interaction are required, but the risk only applies if an application renders Markdown from untrusted input.
Affected
- Python-Markdown 3.0 through 3.11.2
Fixed in
Unknown. No fixed release has been confirmed. Check upstream releases after 3.11.2.
Workaround
- No vendor workaround documented.
- Limit the size of Markdown accepted from users.
Exploitation
- No exploitation in the wild is known.
- Technical details are public (issues #798 and #1654).
Our recommendation
- Inventory where Python-Markdown is used, directly or through MkDocs or other tools.
- Prioritise internet-facing applications that accept Markdown from users.
- Limit the size of user-submitted Markdown and render it with a timeout.
- Check for an upstream fix and update as soon as one is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Python-Markdown issue #798 github.com
- Python-Markdown issue #1654 github.com
- Python-Markdown source inlinepatterns.py github.com
- Python-Markdown pull request #1662 github.com
- Python-Markdown pull request #1664 github.com
- Python-Markdown changelog python-markdown.github.io
- VulDB CVE-2019-25781 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:41.
Original description (NVD)
Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.
NVD references (5)
- https://github.com/Python-Markdown/markdown
- https://github.com/Python-Markdown/markdown/blob/b41e0aaf1181f1a8cb200cf5a815aad7c0020d23/markdown/inlinepatt…
- https://github.com/Python-Markdown/markdown/issues/1654
- https://github.com/Python-Markdown/markdown/issues/798
- https://www.vulncheck.com/advisories/python-markdown-3.0-through-3.11.2-denial-of-service-via-link-bracket-pa…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.