GitHub Advisoryadvisory · PyPI

GHSA-jr9p-r423-9m2r markdown2 Regular Expression Denial of Service

HIGH Published 2021-06-02 Modified 2024-09-30 Official page ↗
Aliases
CVE-2021-26813
Ecosystem
PyPI
Packages
markdown2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2021-05-12

Affected packages

• PyPI markdown2: >= 1.0.1.18, < 2.4.0 → fixed in 2.4.0

Description

markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.

Related

Alias · CVE (1)

  • CVE-2021-26813 markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References