CVE-2026-118694— python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations
Quick assessment
Affected
trentm python-markdown2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
python-markdown2 2.5.5 及更早版本存在一个拒绝服务（DoS）漏洞，允许远程用户通过提交包含未闭合内联链接目标的 Markdown 内容来耗尽 CPU 资源。攻击者可重复提交形如 或 的序列，导致 函数对每个链接重新扫描文档剩余部分，从而产生二次方级别的 CPU 消耗。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118694
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations
Source: CVE Program / CVE List V5
Vulnerability Description
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '
Proof of Concept for CVE-2026-118694 (1)
Vendor Pages for CVE-2026-118694 (1)
IV. Related Vulnerabilities
Same product: python-markdown2
Same weakness: CWE-407
-
CVE-2026-116270
MIME::Words versions before 5.521 for Perl allow memory exha -
CVE-2026-116267
MIME::Parser versions before 5.521 for Perl allow memory exh -
CVE-2026-116133
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaus -
CVE-2026-116795
RE2JS: Quadratic-time denial of service in re2js lookbehind -
CVE-2026-117540
svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via