Bug 2555815 (CVE-2026-111766)

Summary: CVE-2026-111766 markdown-it: markdown-it: Denial of Service via repeated unterminated inline HTML constructs
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: abarbaro, alizardo, amctagga, aoconnor, bniver, cdrage, dschmidt, flucifre, gbenhaim, gmeno, groman, ikhan, jchui, jhe, jlanda, kshier, ktsao, mbenjamin, mhackett, nboldt, niyer, oaljalju, psrna, rbobbitt, rushinde, sdawley, simaishi, sostapov, stcannon, twaugh, vereddy, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in markdown-it. When HTML parsing is enabled, a remote attacker can cause a Denial of Service (DoS) by supplying specially crafted Markdown input containing repeated unterminated inline HTML constructs. The parser repeatedly scans overlapping input while searching for closing tags, leading to quadratic processing time that can block the event loop and render the application or browser thread unresponsive.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-19 20:13:51 UTC 
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.