Public advisory
Python-Markdown — quadratic default-path parse
Coordinated disclosure against PyPI markdown (Python-Markdown): algorithmic-complexity denial of service on the default renderer.
- Sealed complexity gate
- ~2,800×
- Downloads last month
- ~126M
- Differential
- 3,000 docs
What we found
The default parse path grew superlinearly on crafted input. That is a CWE-407 class defect: an attacker-reachable complexity bomb, not a memory-corruption bug and not a scanner finding.
How it was proved
Growth was measured on a sealed complexity gate. The submitted patch is linear on the same inputs and byte-identical against a 3,000-document differential. Metrics were re-measured on pinned inputs — not a screenshot.
What we shipped
A behavior-preserving patch, included with the finding. The oracle still fails on the unpatched renderer and passes on the patched one.
Upstream
Python-Markdown is the library behind the markdown project on PyPI. This page is the studio receipt. The package listing is the upstream surface.