CVE-2019-25781
7.5 HIGHpublic exploit availablePublished 2026-10-29 · Updated 2026-10-29
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-407
Public exploit & PoC references
All references
- https://github.com/Python-Markdown/markdown
- https://github.com/Python-Markdown/markdown/blob/b41e0aaf1181f1a8cb200cf5a815aad7c0020d23/markdown/inlinepatterns.py#L1155-L1172
- https://github.com/Python-Markdown/markdown/issues/1654
- https://github.com/Python-Markdown/markdown/issues/798
- https://www.vulncheck.com/advisories/python-markdown-3.0-through-3.11.2-denial-of-service-via-link-bracket-parsing
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100700PoC
- HIGHCVE-2026-101021PoC
- MEDIUMCVE-2026-102277PoC
- MEDIUMCVE-2026-102461PoC
- HIGHCVE-2026-102994PoC
- HIGHCVE-2026-102997PoC
- HIGHCVE-2026-102999PoC
- UNSCOREDCVE-2026-103604PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.