Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to denial of service (CVE-2026-2327)

Summary Node.js module markdown-it is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to regular expression denial of service ReDoS. This bulletin provides...

CVE-2026-2327 vulnerabilities

Vulnerabilities for packages: semaphore, renovate, vitess, kibana...

CVE-2026-2327

A flaw was found in markdown-it. A remote attacker can exploit this Regular Expression Denial of Service ReDoS vulnerability by providing a specially crafted input containing a long sequence of asterisk characters followed by a non-matching character to the linkify function. This triggers excessi...

11ty-nunjucks-md (1.0.0), 20ful (>=0.3.2, <=0.3.5) +2711 more potentially affected by CVE-2026-2327 via markdown-it (>=13.0.0, <=14.1.0)

markdown-it NPM version =13.0.0, =0.3.2, =0.0.2, =2.0.0-beta.1, =0.3.1, =2.0.4, =0.0.1, =0.33.4, =0.3.0, =10.22.0, =3.7.0-beta.1, =3.9.0-beta.1, =3.9.3 and more Source cves: CVE-2026-2327 Source advisory: OSV:GHSA-38C4-R59V-3VQW...

CVE-2026-2327

The CVE-2026-2327 case concerns the markdown-it package. Affected versions: 13.0.0 through 14.1.0 (and up to 14.1.1 as fixed) are vulnerable to a Regular Expression Denial of Service in the linkify function due to the regex /*$/ used for links; an attacker can provide a long sequence of * follow...

de.digitalcollections.cudami:dc-cudami-admin-webapp (>=7.0.0-rc1, <=8.0.3), io.github.dbmdz.cudami:cudami (>=9.0.0, <=11.0.0-rc.1) +17 more potentially affected by CVE-2026-2327 via org.webjars.npm:markdown-it (>=4.4.0, <=14.3.0)

org.webjars.npm:markdown-it MAVEN version =4.4.0, =7.0.0-rc1, =9.0.0, =1.8.8, =0.4.2, =3.8.0, =0.4.0, =1.5.1, =1.13.2 and more Source cves: CVE-2026-2327 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15282866...

11ty-nunjucks-md (1.0.0), 20ful (>=0.3.2, <=0.3.5) +2711 more potentially affected by CVE-2026-2327 via markdown-it (>=13.0.0, <=14.1.0)

markdown-it NPM version =13.0.0, =0.3.2, =0.0.2, =2.0.0-beta.1, =0.3.1, =2.0.4, =0.0.1, =0.33.4, =0.3.0, =10.22.0, =3.7.0-beta.1, =3.9.0-beta.1, =3.9.3 and more Source cves: CVE-2026-2327 Source advisory: SNYK:JS-MARKDOWNIT-10666750...