Inefficient regular expression complexity in pymdown-extensions - #VU162830
Published: November 9, 2026
Vulnerability identifier: #VU162830
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause denial of service in applications rendering untrusted Markdown with the optional pymdownx.keys extension enabled.
The vulnerability exists due to ambiguous quoted-key regular expressions in pymdown-extensions that trigger exponential backtracking on unterminated quoted keys containing repeated backslashes. An unauthenticated remote attacker can submit a crafted 42-byte Markdown document that consumes approximately 36 seconds of CPU time during rendering.
Affected software
pymdown-extensions
Remediation
Install security update from vendor's website.
pymdown-extensions - update to 11.0.2