CVE-2019-25781Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing

8.7HighCVSS base score
0.42%Exploitation in 30 daysEPSS · top 63% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
YesPublic exploitsa reference or SSVC says so

Description

Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. A reference of the record is tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.

Show the exploits1

References tagged exploit1 reference

GitHub Issue #1654 (opens in a new tab)issue-trackingexploit

Timeline

2026
29 Oct 2026
29 Oct 2026
ID reserved
By VulnCheck
29 Oct 2026
29 Oct 2026
Published
3 Nov 20265 days later
3 Nov 2026· 5 days later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2019-25781, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Awaiting Analysis	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.42% · top 63% of all CVEs (14 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Affected products

Python-Markdown · Markdown
- affected 3.0 – ≤ 3.11.2

References5

GitHub Issue #798 (opens in a new tab)issue-tracking
https://github.com/Python-Markdown/markdown (opens in a new tab)product
GitHub Issue #1654 (opens in a new tab)issue-trackingexploit
https://github.com/Python-Markdown/markdown/blob/b41e0aaf1181f1a8cb200cf5a815aad7c0020d23/markdown/inlinepatterns.py#L1155-L1172 (opens in a new tab)technical-description
VulnCheck Advisory: Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2019-25781](https://cveledger.app/badge/CVE-2019-25781.svg)](https://cveledger.app/cve/CVE-2019-25781)

Record last updated 3 Nov 2026, 15:29 UTC.