Hi,
some additional information on CVE-2019-25781, in case it helps when the
tracker entry is next updated:
- No upstream release fixes this yet. 3.11.3 (released 2026-11-05) does not
change LinkInlineProcessor.getText()/getLink(); both are identical to
3.11.2. The CVE record's "3.0 through 3.11.2" range only reflects the
release that was current when the CVE was published.
- Upstream issue 1654 (listed as a reference) is closed, but it was closed
by its reporter after being pointed to issue 798 as a duplicate; it has no
associated fix. Issue 798 is open (it was auto-closed by PR 1631 on
2026-09-16 and reopened the same day; PR 1631 / commit 5d1363ce4b86 in
3.11.0 fixed a different sub-case, the reference-definition regex, even
though the 3.11.0 changelog lists it under "#798").
- The candidate fixes are two open, unmerged upstream PRs:
PR 1664 "Fix quadratic time for unclosed brackets in link text" (getText;
head 6377adc58cdb)
PR 1680 "Fix quadratic time for unclosed parentheses in link targets"
(getLink; head 66ae093fd55f)
Since the CVE description names both getText() and getLink(), both would be
needed.
Timing of markdown.markdown(s) with Python 3.14 on the extracted Debian
sources:
input '[' * n n=2000 n=4000 n=8000
3.4.1-2+deb12u1 0.92s 3.35s 12.37s
3.7-2+deb13u1 0.72s 2.91s 12.39s
3.10.3-1 0.87s 2.95s 10.81s
3.11.2-1 0.56s 2.36s 9.76s
upstream 3.11.3 0.72s 2.68s 10.36s
PR 1664 head 0.009s 0.016s 0.022s
input '
