CVE-2026-118694 python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118694?
CVE-2026-118694 is a high-severity vulnerability in trentm python-markdown2, published on 28 Oct 2026.
Official description
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time.
Weakness: CWE-407
Which versions are affected by CVE-2026-118694?
How do I fix CVE-2026-118694?
No fix has been published for CVE-2026-118694 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118694 being exploited?
There is no known exploitation of CVE-2026-118694 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-118694, GHSA-rgrp-3mvm-5g9j, UBUNTU-CVE-2026-118694.