Inefficient regular expression complexity in pymdown-extensions - #VU164350
Published: November 10, 2026
Vulnerability identifier: #VU164350
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through excessive CPU consumption in Markdown rendering.
The vulnerability exists due to inefficient regular expression complexity in pymdownx.critic when processing unclosed CriticMarkup, causing quadratic processing time for ordinary markers and cubic processing time for substitutions. A remote attacker can submit untrusted Markdown containing repeated "{++" or "{~~a~>b" sequences without closing markers to tie up a renderer with the extension enabled for seconds to minutes.
Affected software
pymdown-extensions
Remediation
Install security update from vendor's website.
pymdown-extensions - update to 13.0