{"uuid": "3f992d8b-c0c0-48ea-b23b-552bc0e99fc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67422", "type": "seen", "source": "https://gist.github.com/alon710/6f3e0768fc0386f4c965af62333fef78", "content": "# CVE-2026-67422: CVE-2026-67422: Regular Expression Denial of Service in pymdown-extensions\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67422\n\n## Summary\nA high-severity Regular Expression Denial of Service (ReDoS) vulnerability in pymdown-extensions versions prior to 11.0.1 affects the Caret, Tilde, BetterEm, and MagicLink inline processors. When parsing user-supplied Markdown content containing malicious sequences of formatting delimiters, the regular expression engine is forced into catastrophic backtracking, resulting in CPU exhaustion and application denial of service.\n\n## TL;DR\nInefficient regular expressions in multiple inline processors of pymdown-extensions allow unauthenticated attackers to cause complete CPU exhaustion and Denial of Service with short, crafted Markdown payloads of fewer than 50 bytes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1333\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00582 (Percentile: 44.59%)\n- **Impact**: Denial of Service (CPU Exhaustion)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications rendering Markdown using Python Markdown with the pymdown-extensions library.\n- Static site generators and documentation build pipelines utilizing the BetterEm, Caret, Tilde, or MagicLink extensions.\n- **pymdown-extensions**: < 11.0.1 (Fixed in: `11.0.1`)\n\n## Mitigation\n\n- Upgrade pymdown-extensions to version 11.0.1 or higher.\n- Implement maximum character limits on untrusted Markdown inputs at the application layer.\n- Configure WAF rules to detect and block abnormally long sequences of formatting delimiters.\n\n**Remediation Steps:**\n1. Identify all environments containing the pymdown-extensions package.\n2. Update the dependency using your package manager, for example: pip install --upgrade pymdown-extensions>=11.0.1.\n3. Verify the installed version is 11.0.1 or higher using pip show pymdown-extensions.\n4. Deploy the updated application to production and monitor CPU usage patterns.\n\n## References\n\n- [GitHub Security Advisory GHSA-gm37-52c6-37mw](https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw)\n- [Patch Commit c684985](https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67422) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T02:32:35.100867Z"}