CVE-2026-88753
Description
A flaw was found in markdown2. In the extract_metadata function, an inefficient regular expression used to parse document metadata can take an exponential amount of time to process. An attacker can exploit this vulnerability by providing a crafted Markdown document, causing excessive resource consumption and leading to a Denial of Service (DoS).
Statement
A moderate-impact denial of service flaw was found in markdown2, which is shipped as a dependency in the OpenShift Container Platform 4 ose-olm-catalogd-rhel9 container image. When markdown2 renders a document with the opt-in metadata extra enabled, the extract_metadata() function applies an inefficient regular expression to attacker-controlled metadata values, and that pattern can take an exponential amount of time to process. A remote attacker who can supply a crafted Markdown document can trigger excessive CPU consumption in the rendering process, degrading or exhausting the availability of the service that renders it; confidentiality and integrity are not affected. Red Hat has rated this flaw MODERATE with a CVSS 3.1 base score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Upstream analysis characterizes the issue as low-to-moderate because exploitation requires the opt-in metadata extra to be enabled, a meaningful difference from the Red Hat rating. For OpenShift Container Platform 4, the fix is deferred: this flaw is rated MODERATE severity with a CVSS score below 7.0, which does not meet the threshold for filing an update tracker at this time. The residual risk is limited to denial of service of the component that renders untrusted Markdown; there is no impact on confidentiality or integrity.
Mitigation
The vulnerable code path is only reached when markdown2 is used with the opt-in `metadata` extra. Where feasible, applications that render untrusted Markdown should avoid enabling the `metadata` extra; upstream analysis confirms that the same input is processed in linear time when that extra is disabled. Bounding the length of accepted metadata values before parsing can also limit the resource consumption caused by crafted documents. Where these options are not applicable, mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
