CVE-2026-111766
Description
A flaw was found in markdown-it. When HTML parsing is enabled, a remote attacker can cause a Denial of Service (DoS) by supplying specially crafted Markdown input containing repeated unterminated inline HTML constructs. The parser repeatedly scans overlapping input while searching for closing tags, leading to quadratic processing time that can block the event loop and render the application or browser thread unresponsive.
Statement
This vulnerability is rated as having a Low impact because exploitation requires non-standard configurations enabling raw inline HTML parsing, and the impact is confined to temporary CPU consumption or event-loop blockage rather than persistent denial of service or compromise of confidentiality and integrity. In Red Hat products that embed this parser, standard configurations typically leave inline HTML handling disabled, which is unaffected by this flaw. Furthermore, affected components are generally deployed within authenticated developer environments, limiting the exposure to external, unauthenticated attackers.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
