SB20261109131 - Fedora 43 update for markdownlint-cli2
Published: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-111766)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to cause denial of service in applications rendering attacker-controlled Markdown.
The vulnerability exists due to quadratic rescanning in markdown-it's inline HTML parser when repeated unterminated HTML constructs occur inside a paragraph with html: true, including the commonmark preset. An unauthenticated remote attacker can submit a few hundred kilobytes of crafted Markdown to block the Node.js event loop for seconds, delaying other requests.
2) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-111758)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to cause denial of service on servers that render user-supplied Markdown with markdown-it.
The vulnerability exists due to repeated copying of accumulated text in markdown-it's link reference parser when processing multiline definitions with unclosed labels or titles under default options. An unauthenticated remote attacker can submit approximately 800 KB of crafted Markdown to block the Node.js event loop for about 74 seconds.
Remediation
Install update from vendor's website.