CVE-2026-67422: Regular Expression Denial of Service in pymdown-extensions

Vulnerability ID: CVE-2026-67422
CVSS Score: 7.5
Published: 2026-08-07

A high-severity Regular Expression Denial of Service (ReDoS) vulnerability in pymdown-extensions versions prior to 11.0.1 affects the Caret, Tilde, BetterEm, and MagicLink inline processors. When parsing user-supplied Markdown content containing malicious sequences of formatting delimiters, the regular expression engine is forced into catastrophic backtracking, resulting in CPU exhaustion and application denial of service.

TL;DR

Inefficient regular expressions in multiple inline processors of pymdown-extensions allow unauthenticated attackers to cause complete CPU exhaustion and Denial of Service with short, crafted Markdown payloads of fewer than 50 bytes.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-1333
Attack Vector: Network
CVSS Score: 7.5 (High)
EPSS Score: 0.00582 (Percentile: 44.59%)
Impact: Denial of Service (CPU Exhaustion)
Exploit Status: Proof-of-Concept Available
KEV Status: Not Listed

Affected Systems

Applications rendering Markdown using Python Markdown with the pymdown-extensions library.
Static site generators and documentation build pipelines utilizing the BetterEm, Caret, Tilde, or MagicLink extensions.
pymdown-extensions: < 11.0.1 (Fixed in: 11.0.1)

Code Analysis

Commit: c684985

Fix ReDoS vulnerabilities in BetterEm, Caret, Tilde, and MagicLink extensions by using possessive-style negative lookaheads and flattening overlapping patterns.

--- a/pymdownx/betterem.py
+++ b/pymdownx/betterem.py
@@ -64,9 +64,9 @@
-STAR_EM2 = r'(?<!\*)(\*)(?![\*\s])((?:[^\*]|\*{2,})+?)(?<![\*\s])(\*)(?!\*)'
+STAR_EM2 = r'(?<!\*)(\*)(?![\*\s])((?:[^\*]|\*{2,}(?!\*))+?)(?<![\*\s])(\*)(?!\*)'

Exploit Details

GitHub Advisory: Proof of concept and security details covering the ReDoS vulnerabilities.

Mitigation Strategies

Upgrade pymdown-extensions to version 11.0.1 or higher.
Implement maximum character limits on untrusted Markdown inputs at the application layer.
Configure WAF rules to detect and block abnormally long sequences of formatting delimiters.

Remediation Steps:

Identify all environments containing the pymdown-extensions package.
Update the dependency using your package manager, for example: pip install --upgrade pymdown-extensions>=11.0.1.
Verify the installed version is 11.0.1 or higher using pip show pymdown-extensions.
Deploy the updated application to production and monitor CPU usage patterns.