~ / search / GHSA-jr9p-r423-9m2r

GHSA-jr9p-r423-9m2r

markdown2 Regular Expression Denial of Service

Source: GitHub Advisory Database (reviewed) High CVE-2021-26813

Packages

EcosystemPackageAffectedFixed in
PyPI markdown2 >= 1.0.1.18, < 2.4.0 2.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.

References

External links from the advisory. They lead to third-party sites.