CVE-2026-88753 Denial of service in n/a
Attackers can cause a Denial of Service in the markdown2 library by submitting a crafted Markdown document that triggers excessive regex processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-88753?
CVE-2026-88753 is a high-severity denial of service vulnerability in n/a, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.
Weakness: CWE-400
Which versions are affected by CVE-2026-88753?
Linux distribution packages (1)
python-markdown2 openSUSE:Tumbleweed | All versions | 2.5.5-2.1 |
How do I fix CVE-2026-88753?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-88753 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88753 exists.
Sources
Also known as DEBIAN-CVE-2026-88753, GHSA-vv85-hg53-g6g2, UBUNTU-CVE-2026-88753, openSUSE-SU-2026:12159-1.