Bug 2490150 (CVE-2026-48988)

Summary:	CVE-2026-48988 markdown-it: markdown-it: Denial of Service via quadratic processing of smartquotes with typographer enabled
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abarbaro, alizardo, amctagga, aoconnor, bniver, cdrage, dschmidt, flucifre, gbenhaim, gmeno, groman, jchui, jhe, jlanda, kshier, ktsao, mbenjamin, mhackett, nboldt, niyer, oaljalju, psrna, rushinde, sdawley, simaishi, sostapov, stcannon, teagle, twaugh, vereddy, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in markdown-it, a Markdown parser. A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) when the `typographer` option is enabled. This occurs due to inefficient processing of smartquotes, leading to excessive CPU consumption when parsing specially crafted, quote-heavy markdown input. This can degrade or disrupt service availability for affected applications.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2526255, 2526257, 2526258, 2526259, 2526260, 2526261, 2526256, 2526262
Bug Blocks:

Description OSIDB Bzimport 2026-06-17 21:01:16 UTC

markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.