Read the docs
TI-2026-47703 Aliases CVE-2026-67422GHSA-gm37-52c6-37mw

pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

Priority HIGH 72CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can submit Markdown to cause denial of service. The exposure is concrete for web applications that render user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build untrusted Markdown. The issue has been fixed in version 11.0.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00608 49th percentileScored 2026-11-07
Fix Fixed pymdown-extensions (facelessuser): 11.0.1pymdown-extensions (PyPI): 11.0.1Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
facelessuserpymdown-extensionsbefore 11.0.111.0.1Patch availableCNA
—pymdown-extensions (PyPI)before 11.0.111.0.1Patch availableGHSA-gm37-52c6-37mw
  • pymdown-extensions Vendorfacelessuser Affected before 11.0.1 Fixed in 11.0.1 Patch available CNA
  • pymdown-extensions (PyPI) Vendor— Affected before 11.0.1 Fixed in 11.0.1 Patch available GHSA-gm37-52c6-37mw

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:facelessuser:pymdown_extensions:*:*:*:*:*:*:*:*——facelessuser
  • cpe:2.3:a:facelessuser:pymdown_extensions:*:*:*:*:*:*:*:* Versions — — ·facelessuser

Remediation

  • Fix · CNA pymdown-extensions (facelessuser) Fixed in 11.0.1
  • Fix · GHSA-gm37-52c6-37mw pymdown-extensions (PyPI) Fixed in 11.0.1 Advisory →

Red Hat 3 advisories

  • RHSA-2026:79088 Released 2026-10-08 · Red Hat rating Critical
    Red Hat Developer Hub 1.10.5 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:69248 Released 2026-09-21 · Red Hat rating Important
    Red Hat Developer Hub 1.9.9 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:66003 Released 2026-09-09 · Red Hat rating Important
    Ansible automation portal Red Hat Enterprise Linux Images
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:66003
Red Hat Developer Hub 1.10Fixed RHSA-2026:79088
Red Hat Developer Hub 1.9Fixed RHSA-2026:69248
Not affected: 4 products
  • Red Hat Developer Hub 1.10
  • Red Hat Developer Hub 1.9
  • Red Hat Hardened Images
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-67422
  2. 2026-10-03 Alias added: GHSA-gm37-52c6-37mw
  3. 2026-10-09 Fix available: RHSA-2026:79088 · Red Hat
  4. 2026-10-09 Fix available: Red Hat Developer Hub 1.10 · Red Hat

References

Advisory 1

Other 3

  • TI-2026-36631 Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser CVSS 3.1HIGH 7.5
  • TI-2026-36630 Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve CVSS 3.1HIGH 7.5
  • TI-2023-15603 Arbitrary file inclusion with the pymdowm-snippets extension CVSS 3.1HIGH 7.5
  • TI-2026-58861 Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns CVSS 3.1MEDIUM 5.3
  • TI-2026-58860 Regular expression denial of service in facelessuser soupsieve CVSS 3.1MEDIUM 5.3
  • TI-2026-44140 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences