CVE-2026-88753

HighCVSS 7.5/10Last modified Oct 20, 2026

Description

A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-887557.8Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace conf CVE-2026-887565.3Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public logi CVE-2026-88767.3Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis ale CVE-2026-887615.3The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are adver CVE-2026-887635.9A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between dist CVE-2026-887645.4The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification ma CVE-2026-887658.5GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under cer CVE-2026-88776.4The Responsive Video Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rem_video' shortcode in versions up CVE-2026-887706.5A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because th CVE-2026-887719.8Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, be CVE-2026-887728.1Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14 CVE-2026-8877310.0Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler