{"id":"AZL-112457","summary":"CVE-2019-25781 affecting package python-markdown 3.8.2-3","details":"Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.","modified":"2026-11-02T14:18:11.693155643Z","published":"2026-10-29T14:17:39Z","upstream":["CVE-2019-25781"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25781"}],"affected":[{"package":{"name":"python-markdown","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/python-markdown"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.8.2-3"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112457.json"}}],"schema_version":"1.9.2"}