Inefficient regular expression complexity in pymdown-extensions - #VU162829
Published: November 9, 2026
Vulnerability identifier: #VU162829
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust rendering workers and deny service in downstream applications using pymdown-extensions.
The vulnerability exists due to quadratic regular expression processing of crafted Markdown in explicitly enabled pymdownx.tilde or pymdownx.caret extensions using default smart processing. An unauthenticated remote attacker can submit repeated requests containing crafted delimiter sequences to services synchronously rendering untrusted Markdown without input-size or rendering-time limits, consuming excessive CPU.
Affected software
pymdown-extensions
Remediation
Install security update from vendor's website.
pymdown-extensions - update to 12.0