CVE-2026-67422: 
Python vulnerability analysis and mitigation

CVE-2026-67422 is a Regular Expression Denial of Service (ReDoS) vulnerability in pymdown-extensions, a collection of extensions for the Python Markdown library. Four inline processors — caret, tilde, betterem, and magiclink — use regular expressions susceptible to catastrophic backtracking, allowing an unauthenticated remote attacker to cause unbounded CPU consumption with a crafted Markdown input under 50 bytes. All versions up to and including 11.0 are affected; the issue was fixed in version 11.0.1. The vulnerability was reported by researcher seankohjs, published on July 29, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is CWE-1333 (Inefficient Regular Expression Complexity): inner content groups in the affected regexes can partition a run of delimiter characters (^, ~, _, or .) into {2,}-sized pieces in exponentially many ways, wrapped in a lazy +? quantifier that forces the engine to exhaust all possibilities before failing. The vulnerable regexes are SUP2 in pymdownx/caret.py:56, SUB2 in pymdownx/tilde.py:55, SMART_UNDER_EM2 in pymdownx/betterem.py:93, and RE_LINK (host subexpression) in pymdownx/magiclink.py:56. The caret/tilde/betterem vulnerability was introduced in PR #2547 (first released in v10.13, December 2024), while magiclink's host pattern is long-standing. Exploitation requires only that an attacker submit a single malformed Markdown line (e.g., ^a^^^...b for caret) through any user-facing input that invokes markdown.markdown() with the affected extensions in their default configuration — no authentication or special privileges are needed (Github Advisory, Github Advisory).

Successful exploitation causes the rendering thread to consume 100% CPU indefinitely, with no associated memory pressure, making the denial of service difficult to detect via OOM monitoring. A single malicious input under 50 bytes is sufficient to stall the renderer for seconds at ~45 bytes, with rendering time growing exponentially with each additional character — extending a few more characters pushes render time into minutes or beyond. The impact is limited to availability (no confidentiality or integrity loss), but affected applications include any Python web app rendering user-supplied Markdown (comments, wikis, issue bodies, live preview), any app using pymdownx.extra (which bundles the vulnerable betterem default), and hosted docs/CI systems processing untrusted Markdown (Github Advisory).

A public proof-of-concept script was included in the security advisory, demonstrating reproducible hangs across all four extensions using inputs under 50 bytes via the standard markdown.markdown() API with default configuration (Github Advisory). The vulnerability is automatable (no user interaction required) and requires no authentication or privileges, making it trivially weaponizable against any exposed Markdown rendering endpoint. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.582% (45th percentile), and the vulnerability does not appear in the CISA KEV catalog (Github Advisory).

1. Reconnaissance: Identify web applications or services that render user-supplied Markdown using pymdown-extensions ≤ 11.0 — look for comment boxes, wiki editors, issue trackers, or live preview features built with Python/MkDocs/Material for MkDocs stacks.
2. Determine active extensions: Check if the target uses pymdownx.caret, pymdownx.tilde, pymdownx.betterem, pymdownx.magiclink, or pymdownx.extra (which bundles betterem by default). This can often be inferred from rendered output or documentation.
3. Craft malicious payload: Construct a short (<50 byte) malformed Markdown string targeting the relevant extension, for example:
   • caret: ^a + ^ × N + b (e.g., ^a^^^^^^^^^^^^^^^^^^^^^^^^^^^^b at N=30+)
   • tilde: ~a + ~ × N + b
   • betterem: _a + _ × N + b
   • magiclink: http://a + . × N + (space-terminated)
4. Submit payload: Send the crafted string via the application's Markdown input field (e.g., comment submission, wiki edit, issue body, or live preview API endpoint).
5. Trigger DoS: The rendering thread processes the input, enters catastrophic backtracking, and pins at 100% CPU — causing the service to become unresponsive. Repeated submissions can sustain the denial of service (Github Advisory).

• Network: Repeated HTTP POST requests to Markdown rendering endpoints (e.g., comment submission, wiki edit, issue creation APIs) with short payloads (under 50 bytes) containing runs of ^, ~, _ characters or malformed URLs like http://a.... followed by a space.
• Process: Python worker processes (e.g., gunicorn, uwsgi, celery) sustaining 100% CPU utilization for extended periods without corresponding memory growth; rendering threads that do not return within expected timeouts.
• Logs: Application logs showing Markdown rendering requests that never complete or time out; web server access logs with repeated short-body POST requests to the same rendering endpoint from the same or rotating source IPs.
• Application Behavior: Service degradation or complete unavailability of Markdown-rendering features while other application functions remain operational, consistent with thread starvation rather than resource exhaustion (Github Advisory).

Upgrade pymdown-extensions to version 11.0.1, which rewrites the vulnerable regex patterns in betterem.py, tilde.py, caret.py, and magiclink.py to eliminate delimiter-run partition ambiguity (Patch Commit). For applications that cannot immediately upgrade, implement the following mitigations: (1) enforce strict input length limits on user-supplied Markdown before rendering; (2) disable the vulnerable inline processors (caret, tilde, betterem, magiclink) if not required by the application; (3) implement rendering timeouts to prevent thread starvation; (4) run Markdown rendering in isolated worker processes with CPU time limits so a hung render does not affect the main application (Github Advisory, Red Hat Bugzilla).

The vulnerability was reported by security researcher seankohjs and acknowledged by the pymdown-extensions maintainer (facelessuser), who released the fix in version 11.0.1 promptly after disclosure (Github Advisory). Red Hat tracked the issue via Bugzilla with high severity and high priority, indicating downstream concern for distributions shipping pymdown-extensions (Red Hat Bugzilla). The vulnerability was also picked up by Tenable (Nessus plugin 333354), GitLab advisories, and CISA's weekly vulnerability bulletin, reflecting broad industry awareness of the issue.