CVE-2019-25781 in Python-Markdown
Summary
by MITRE • 10/29/2026
Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The Python-Markdown library, a widely used tool for converting Markdown text into HTML, contains an algorithmic complexity vulnerability affecting versions 3.0 through 3.11.2. This flaw resides specifically within the inline link parsing logic and is classified as a ReDoS-like or quadratic time complexity issue rather than a traditional regular expression denial of service. The core technical defect lies in how the LinkInlineProcessor processes input strings containing unmatched opening brackets, such as repeated instances of [ or ![ characters without corresponding closing delimiters. When an attacker submits Markdown content with these specific patterns, the internal parsing methods getText and getLink are forced to perform exhaustive searches that scale quadratically relative to the length of the input string. This means that even a relatively short sequence of maliciously crafted brackets can trigger computational overhead proportional to the square of the input size, leading to significant performance degradation.
From an operational perspective, this vulnerability poses a severe risk of Denial of Service against applications that rely on Python-Markdown for user-generated content processing. Because many web frameworks and static site generators process Markdown inputs in real-time or during request handling, an attacker can exploit this flaw by sending specially crafted HTTP requests containing the malicious markdown strings. The resulting CPU exhaustion keeps worker threads busy for extended periods, effectively blocking them from serving legitimate traffic. In environments where concurrency is limited by thread count or resource constraints, such as typical web server configurations with a fixed number of workers, this attack vector can render the entire service unavailable to all users, not just the attacker. This represents a classic availability impact scenario where system resources are consumed disproportionately by malicious input.
The vulnerability aligns closely with CWE-400, which describes Uncontrolled Resource Consumption, specifically highlighting issues related to algorithmic complexity that lead to resource exhaustion. Furthermore, in the context of the MITRE ATT&CK framework, this behavior maps to T1496, Host Denial of Service, where an adversary uses techniques like CPU or memory consumption to disrupt service availability. It also relates to CWE-730, which covers timing attacks based on algorithmic complexity, although here the primary impact is resource exhaustion rather than information leakage. The quadratic nature of the scan means that small increases in input length result in disproportionately large increases in processing time, a characteristic often exploited by attackers to maximize damage with minimal effort and bandwidth usage.
Mitigation strategies for this vulnerability primarily involve upgrading the Python-Markdown library to version 3.12 or later, where the parsing logic has been optimized to handle such edge cases efficiently without quadratic complexity. For organizations unable to immediately upgrade their dependencies due to compatibility constraints, several defensive measures can be implemented at the application layer. Input validation should be enforced to limit the length of Markdown strings processed by the library and to filter out patterns that resemble unmatched bracket sequences before they reach the parser. Additionally, implementing timeout mechanisms for markdown conversion tasks ensures that any single parsing operation cannot consume excessive CPU time or block worker threads indefinitely. Deploying a Web Application Firewall with rules designed to detect anomalous input lengths or specific character repetition patterns can also provide an additional layer of defense against exploitation attempts targeting this algorithmic flaw.