Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-06T20:26:31 pymdown-extensions: Pymdown-extensions: Denial of Service via Regular Expression Vulnerability 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-1333

A flaw was found in pymdown-extensions, a collection of extensions for the Python Markdown library. This vulnerability, known as a Regular Expression Denial of Service (ReDoS), arises from how certain inline processors handle regular expressions. An unauthenticated remote attacker can exploit this by submitting a short, untrusted Markdown line that causes the regular expression engine to perform an excessive number of calculations. This leads to unbounded CPU usage, effectively causing a denial of service for affected web applications or systems that process user-supplied Markdown.

This vulnerability is rated Important as it enables an unauthenticated remote attacker to trigger a Regular Expression Denial of Service (ReDoS) in Red Hat products that render untrusted Markdown via `pymdown-extensions`. Catastrophic backtracking in specific inline processors can lead to excessive CPU usage and service disruption. Red Hat Developer Hub Affected rhdh/rhdh-hub-rhel9 Red Hat Hardened Images Affected grafana12.4 Red Hat Hardened Images Affected grafana13.1 Red Hat Hardened Images Not affected trivy Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-olm-catalogd-rhel9 Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-67422 https://nvd.nist.gov/vuln/detail/CVE-2026-67422 https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw