Bug 2555740 (CVE-2026-111759)

Summary:	CVE-2026-111759 markdown-it: markdown-it: Denial of Service via mismatched quote parsing
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abarbaro, alizardo, amctagga, aoconnor, bniver, cdrage, dschmidt, flucifre, gbenhaim, gmeno, groman, ikhan, jchui, jhe, jlanda, kshier, ktsao, mbenjamin, mhackett, nboldt, niyer, oaljalju, psrna, rbobbitt, rushinde, sdawley, simaishi, sostapov, stcannon, twaugh, vereddy, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in markdown-it. A remote attacker can trigger a Denial of Service (DoS) by submitting specially crafted Markdown input containing numerous mismatched quotation marks when typographer mode is enabled. This input causes the parser to repeatedly rescan quote tokens, resulting in quadratic processing time and excessive CPU consumption.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-19 17:53:05 UTC

markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, smartquotes is affected: many opening quotes of one type followed by unmatched closing quotes of the other type cause the smartquotes rule to repeatedly scan the entire opener stack, resulting in quadratic processing time. The root cause is each mismatched quote closer repeatedly scans the opener stack for a compatible quote type. The attack mechanism is quadratic rescanning of the quote opener stack. The affected identifiers are smartquotes and typographer. The trigger conditions are attacker-controlled Markdown with many openers of one quote type and unmatched closers of the other type and typographer mode is enabled. The impact is denial of service through excessive parsing time. The vulnerable path requires typographer mode; disabling typographer or the smartquotes rule prevents the affected processing. This issue is fixed in versions 14.3.2 and 15.0.2.