ZeroDay Findings
Sign inSign up

Findings

CVE-2026-88753

A Regular-Expression Denial of Service (ReDoS) in the Markdown2.

Published Oct 15, 2026 · updated Oct 16, 2026

A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · NIST NVD

    Detected

    A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.

  2. Oct 16, 2026 · OSV.dev

    Updated

    A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.

Affected

  • Debian:12 python-markdown22.4.1-1, 2.4.11-1, 2.5.3-1~exp1
  • Debian:13 python-markdown22.4.11-1, 2.5.3-1~exp1, 2.5.4-1
  • Debian:14 python-markdown22.4.11-1, 2.5.3-1~exp1, 2.5.4-1

Sources

  • CVE.orgVulnerability recordCVE-2026-88753

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-88753

    A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.

    nvd.nist.gov
  • OSV.devPackage advisoryDEBIAN-CVE-2026-88753
    osv.dev

References