Description
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| trentm | python-markdown2 | ≤ 2.5.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-markdown2 | No fix yet | — |
| Debian 13 | python-markdown2 | No fix yet | — |
| Debian 12 | python-markdown2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-markdown2 | No fix yet | — |
| Ubuntu 26.04 LTS | python-markdown2 | No fix yet | — |
| Ubuntu 24.04 LTS | python-markdown2 | No fix yet | — |
| Ubuntu 22.04 LTS | python-markdown2 | No fix yet | — |
| Ubuntu 20.04 LTS | python-markdown2 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-markdown2 | 2.5.5-3.1 | openSUSE-SU-2026:12422-1 |
Advisories 1
- openSUSE-SU-2026:12422-1 python313-markdown2-2.5.5-3.1 on GA media SUSE / openSUSE Security Updates · Nov 5, 2026
References
- GitHub Issue #750 issue-tracking
- https://github.com/trentm/python-markdown2 product
- https://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L1478-L1492 technical-description
- https://github.com/trentm/python-markdown2/blob/2.5.5/lib/markdown2.py#L3029 technical-description
- https://github.com/trentm/python-markdown2/pull/751 patch issue-tracking
- VulnCheck Advisory: python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations third-party-advisory