CVE-2026-67422

pymdown-extensions: ReDoS in inline processors leads to Denial of Service.

• CVSS 7.5
• 1333
• Resource Management
• Remote

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can submit Markdown to cause denial of service. The exposure is concrete for web applications that render user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build untrusted Markdown. The issue has been fixed in version 11.0.1.

CVE

CVE-2026-67422

CWE

1333

CVSS base score

7.5

Published

2026-08-06

OWASP

A04 Insecure Design

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

pymdown-exte

Fixed by upgrading

Yes

Solution

Upgrade to `pymdown-extensions` version 11.0.1 or later.

from markdown.inlinepatterns import InlineProcessor
from markdown import util

# VULNERABLE: The pattern's alternation allows for multiple ways to match the same content, leading to catastrophic backtracking.
CARET_RE = r'(\^{2})([^\^]+?|[^\^]\s[^\^]+?)(\^{2})'


class CaretInlineProcessor(InlineProcessor):
    """Handle caret inserts."""

    def __init__(self, pattern, md=None):
        """Initialize."""
        super().__init__(pattern, md)

    def handleMatch(self, m, data):
        """Handle caret match."""
        el = util.etree.Element('ins')
        el.text = m.group(2)
        return el, m.start(0), m.end(0)


class CaretExtension(util.Extension):
    """Caret extension."""

    def extendMarkdown(self, md):
        """Insert `<ins>` tags."""
        md.inlinePatterns.register(
            CaretInlineProcessor(CARET_RE, md), 'caret', 175
        )

from markdown.inlinepatterns import InlineProcessor
from markdown import util

# FIX: The pattern is rewritten with a negative lookahead to ensure content is matched efficiently without backtracking.
CARET_RE = r'(\^{2})((?:[^\^]|\s(?!\^{2}))+?)(\^{2})'


class CaretInlineProcessor(InlineProcessor):
    """Handle caret inserts."""

    def __init__(self, pattern, md=None):
        """Initialize."""
        super().__init__(pattern, md)

    def handleMatch(self, m, data):
        """Handle caret match."""
        el = util.etree.Element('ins')
        el.text = m.group(2)
        return el, m.start(0), m.end(0)


class CaretExtension(util.Extension):
    """Caret extension."""

    def extendMarkdown(self, md):
        """Insert `<ins>` tags."""
        md.inlinePatterns.register(
            CaretInlineProcessor(CARET_RE, md), 'caret', 175
        )

*************************************

@misc{vaitp:cve202667422,
  title        = {{pymdown-extensions: ReDoS in inline processors leads to Denial of Service.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-67422},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-67422/}}
}