python-markdown2 through version 2.5.5 contains a denial of service flaw that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Repeating sequences such as "[a](" or "![a](" causes an internal function to rescan the remaining document for each link, resulting in quadratic CPU consumption. The vulnerability is categorized as CWE-407, insecure resource consumption, and can be triggered without authentication.

The vulnerable component is python-markdown2 from the Python‑Markdown2 project. All releases up to and including 2.5.5 are affected. The library is often embedded in web applications or content management systems that render user‑supplied Markdown.

The flaw has a CVSS score of 8.7, indicating a high‑severity denial of service that can be triggered by an unauthenticated attacker. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, so the current exploitation probability remains unclear. Attackers can remotely exercise the vulnerability by submitting crafted Markdown to any service that uses the vulnerable library. Simple patterns such as "[a](" or "![a](" can trigger quadratic CPU usage, potentially exhausting server resources.