CVE-2025-68142 is a vulnerability classified under CWE-1333, related to inefficient regular expression complexity, found in the facelessuser pymdown-extensions Python library. The issue exists in the figure caption extension (pymdownx.blocks.caption) prior to version 10.16.1. When processing markdown content, this extension uses a regular expression that can exhibit exponential backtracking behavior if fed with specially crafted input, leading to a Regular Expression Denial of Service (ReDOS). This causes the markdown processor to hang or consume excessive CPU resources, resulting in denial of service. The vulnerability can be exploited remotely without authentication or user interaction by submitting malicious markdown content to systems that utilize the vulnerable extension for rendering or processing user-supplied markdown. The vulnerability is mitigated by upgrading to pymdown-extensions version 10.16.1 or later, where the problematic regex has been fixed. As a temporary workaround, disabling or avoiding the use of the figure caption extension when processing untrusted content can reduce risk. The vulnerability does not affect confidentiality or integrity but impacts availability by enabling resource exhaustion. No known exploits are currently reported in the wild.

For European organizations, the primary impact is availability degradation due to potential denial-of-service conditions when processing malicious markdown content with vulnerable pymdown-extensions versions. This can affect web applications, content management systems, documentation platforms, or any service that renders or processes user-generated markdown using the vulnerable extension. Organizations relying on automated markdown rendering pipelines or collaborative documentation tools could experience service interruptions or degraded performance. Although the vulnerability does not expose sensitive data or allow code execution, the disruption of services can impact business continuity and user experience. The low CVSS score reflects the limited scope and ease of mitigation, but organizations with high markdown content exposure should prioritize patching to prevent potential abuse. The absence of known exploits reduces immediate risk but does not eliminate the threat of future attacks.

European organizations should immediately upgrade facelessuser pymdown-extensions to version 10.16.1 or later to remediate the ReDOS vulnerability. Until upgrades are possible, disable or avoid using the pymdownx.blocks.caption extension when processing untrusted markdown content. Implement input validation and size limits on markdown content submitted by users to reduce the risk of resource exhaustion. Employ processing timeouts or sandboxing techniques for markdown rendering services to prevent long hangs. Monitor application logs and performance metrics for unusual spikes in CPU or processing time that may indicate exploitation attempts. Educate developers and DevOps teams about the vulnerability and ensure dependencies are regularly audited for security updates. Consider using alternative markdown processing libraries without known ReDOS issues if upgrading is delayed.