---
id: CVE-2019-25781
title: Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing
summary: >-
  Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity
  vulnerability in inline link parsing that allows remote attackers to exhaust
  CPU through unmatched brackets. Attackers can submit short Markdown containing
  repeated [ …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-407
vendor: Python-Markdown
product: Markdown
affected:
  - Markdown >= 3.0 <= 3.11.2
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T13:08:49.597Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2019-25781'
references:
  - url: 'https://github.com/Python-Markdown/markdown/issues/798'
    label: 'GitHub Issue #798'
  - url: 'https://github.com/Python-Markdown/markdown'
  - url: 'https://github.com/Python-Markdown/markdown/issues/1654'
    label: 'GitHub Issue #1654'
  - url: >-
      https://github.com/Python-Markdown/markdown/blob/b41e0aaf1181f1a8cb200cf5a815aad7c0020d23/markdown/inlinepatterns.py#L1155-L1172
  - url: >-
      https://www.vulncheck.com/advisories/python-markdown-3.0-through-3.11.2-denial-of-service-via-link-bracket-parsing
    label: >-
      VulnCheck Advisory: Python-Markdown 3.0 through 3.11.2 Denial of Service
      via Link Bracket Parsing
tags:
  - cve.org
epss: 0.00422
epssPercentile: 0.36552
ingestedAt: '2026-11-01T18:59:04.480Z'
---

## Overview

Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.

## Affected

- `Markdown >= 3.0 <= 3.11.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.