CVE-2026-67422

CVE-2026-67422 affects pymdown-extensions up to version 11.0, where four inline processors—caret, tilde, betterem, and magiclink—use regex patterns whose groups can partition delimiter runs in exponentially many ways. This causes catastrophic backtracking and unbounded CPU usage when rendering a ...

CVE-2026-67422 pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...