CVE-2026-88753 Details

A Regular-Expression Denial-of-Service (ReDoS) vulnerability has been identified in the Trentm Markdown2 library, specifically in the extract_metadata() function of lib/markdown2.py, affecting versions through 2.5.5. This vulnerability allows attackers to cause a Denial of Service (DoS) by exploiting the metadata parsing feature with a crafted Markdown document. The issue arises from overlapping, unbounded space-matching quantifiers in the regular expression used to parse metadata values, leading to super-linear backtracking and excessive CPU consumption.

To address this vulnerability, the regular expression used in the metadata parsing can be rewritten to eliminate the overlapping space quantifiers, or the length of metadata values can be bounded before applying the regex. Alternatively, the 'regex' module's atomic groups or possessive quantifiers can be used to prevent the backtracking issue.