CVE-2026-67422 in pymdown-extensions
Summary
by MITRE • 08/07/2026
pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can submit Markdown to cause denial of service. The exposure is concrete for web applications that render user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build untrusted Markdown. The issue has been fixed in version 11.0.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in pymdown-extensions represents a critical denial of service threat stemming from catastrophic backtracking in regular expression implementations within four specific inline processors. This flaw affects versions up to and including 11.0 where the caret, tilde, betterem, and magiclink processors utilize regular expressions containing content groups that can create exponentially many partitions of delimiter character runs. The mathematical complexity of these regex patterns causes the backtracking algorithm to explore an exponential number of possible matches for each input sequence, leading to severe performance degradation that scales disproportionately with input length.
The technical implementation of this vulnerability resides in how these processors handle delimiter characters through regular expressions that employ content groups susceptible to pathological backtracking behavior. When processing user-supplied Markdown content, particularly in web applications where users can submit comments, wiki entries, or issue descriptions, an attacker can craft malicious inputs that trigger this exponential computational complexity. The vulnerability manifests when a single untrusted Markdown line under 50 bytes is processed through the markdown.markdown() function with default configurations, causing CPU usage to grow exponentially rather than linearly with input size. This behavior directly violates the expected performance characteristics of text processing operations and creates a clear path for resource exhaustion attacks.
The operational impact extends across numerous vulnerable systems including web applications that render user-generated Markdown content, documentation systems, continuous integration environments, and hosted platforms that process untrusted markdown inputs. Applications using pymdownx.extra which bundles the vulnerable betterem default configuration are particularly at risk since this extension is commonly included in many documentation and collaboration platforms. The attack surface encompasses not only individual application instances but also entire infrastructure components that process untrusted user input through Markdown rendering pipelines, making this vulnerability particularly dangerous for service providers and platform operators.
This vulnerability aligns with CWE-624 and follows patterns consistent with the ATT&CK technique T1499.004 for network denial of service attacks. The exploit requires minimal privileges as it targets unauthenticated remote input processing, making it accessible to any user capable of submitting Markdown content to affected systems. The fix implemented in version 11.0.1 addresses the core regex implementation issues by modifying the regular expression patterns to eliminate the exponential backtracking possibilities, thereby restoring reasonable computational complexity to the text processing operations while maintaining the intended functionality of the inline processors.
Organizations using pymdown-extensions should prioritize immediate upgrading to version 11.0.1 or later to prevent exploitation of this vulnerability. Additionally, implementing input validation and rate limiting mechanisms can provide additional defense-in-depth measures against potential abuse of this denial of service vulnerability in environments where upgrading may not be immediately feasible. The remediation approach demonstrates the importance of careful regex design and performance testing in text processing libraries that handle untrusted input, emphasizing the need for security-conscious development practices in widely-used software components.