pymdown-extensions versions up to and including 11.0 contain inefficient regular expressions in four inline processors (caret, tilde, betterem, and magiclink). These regexes have content groups that partition delimiter runs in exponentially many ways, causing catastrophic backtracking. When an attacker submits a single crafted Markdown line under 50 bytes, the rendering thread enters unbounded CPU usage that grows exponentially with input length. This enables denial of service in any application using markdown.markdown() with default configurations of these extensions. The vulnerability is fixed in version 11.0.1.

An unauthenticated remote attacker who can submit Markdown content can cause a denial of service by triggering excessive CPU consumption during Markdown rendering. This affects web applications and hosted documentation or CI systems that render untrusted Markdown using pymdown-extensions up to version 11.0. There is no impact on confidentiality or integrity, only availability.

Upgrade pymdown-extensions to version 11.0.1 or later, where the inefficient regular expressions causing catastrophic backtracking have been fixed. Until upgraded, avoid rendering untrusted Markdown using the vulnerable inline processors or disable the affected extensions if possible. Patch status is confirmed by the vendor fix in 11.0.1.