DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-67422: CVE-2026-67422: Regular Expression Denial of Service in pymdown-extensions

#security #cve #cybersecurity

CVE-2026-67422: Regular Expression Denial of Service in pymdown-extensions

Vulnerability ID: CVE-2026-67422
CVSS Score: 7.5
Published: 2026-08-07

A high-severity Regular Expression Denial of Service (ReDoS) vulnerability in pymdown-extensions versions prior to 11.0.1 affects the Caret, Tilde, BetterEm, and MagicLink inline processors. When parsing user-supplied Markdown content containing malicious sequences of formatting delimiters, the regular expression engine is forced into catastrophic backtracking, resulting in CPU exhaustion and application denial of service.

TL;DR

Inefficient regular expressions in multiple inline processors of pymdown-extensions allow unauthenticated attackers to cause complete CPU exhaustion and Denial of Service with short, crafted Markdown payloads of fewer than 50 bytes.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-1333
  • Attack Vector: Network
  • CVSS Score: 7.5 (High)
  • EPSS Score: 0.00582 (Percentile: 44.59%)
  • Impact: Denial of Service (CPU Exhaustion)
  • Exploit Status: Proof-of-Concept Available
  • KEV Status: Not Listed

Affected Systems

  • Applications rendering Markdown using Python Markdown with the pymdown-extensions library.
  • Static site generators and documentation build pipelines utilizing the BetterEm, Caret, Tilde, or MagicLink extensions.
  • pymdown-extensions: < 11.0.1 (Fixed in: 11.0.1)

Code Analysis

Commit: c684985

Fix ReDoS vulnerabilities in BetterEm, Caret, Tilde, and MagicLink extensions by using possessive-style negative lookaheads and flattening overlapping patterns.

--- a/pymdownx/betterem.py
+++ b/pymdownx/betterem.py
@@ -64,9 +64,9 @@
-STAR_EM2 = r'(?<!\*)(\*)(?![\*\s])((?:[^\*]|\*{2,})+?)(?<![\*\s])(\*)(?!\*)'
+STAR_EM2 = r'(?<!\*)(\*)(?![\*\s])((?:[^\*]|\*{2,}(?!\*))+?)(?<![\*\s])(\*)(?!\*)'
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub Advisory: Proof of concept and security details covering the ReDoS vulnerabilities.

Mitigation Strategies

  • Upgrade pymdown-extensions to version 11.0.1 or higher.
  • Implement maximum character limits on untrusted Markdown inputs at the application layer.
  • Configure WAF rules to detect and block abnormally long sequences of formatting delimiters.

Remediation Steps:

  1. Identify all environments containing the pymdown-extensions package.
  2. Update the dependency using your package manager, for example: pip install --upgrade pymdown-extensions>=11.0.1.
  3. Verify the installed version is 11.0.1 or higher using pip show pymdown-extensions.
  4. Deploy the updated application to production and monitor CPU usage patterns.

References

Read the full report for CVE-2026-67422 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)