CVE-2019-25781

HighCVSS 7.5

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

37th percentile - higher than 37% of all known CVEs

Summary

Python-Markdown versions 3.0 through 3.11.2 contain an algorithmic complexity vulnerability in inline link parsing that allows remote CPU exhaustion via unmatched brackets. A short Markdown payload with repeated [ or ![ characters forces quadratic scans in LinkInlineProcessor.getText() and getLink(), keeping workers busy for minutes.

Risk Assessment

An attacker can send a small payload that exhausts CPU resources and blocks Markdown processing. This leads to denial of service in applications rendering untrusted content.

Recommendation

Update Python-Markdown to a version later than 3.11.2. Until patched, limit the size and complexity of processed Markdown and enforce processing timeouts.

Other vulnerabilities in Python-Markdown

CVE-2025-69534High
Python-Markdown version 3.8 contains a vulnerability where malformed HTML-like sequences cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application processing attacker-controlled Markdown may crash.

Original NVD description (English source)

Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS