The vulnerability is a Regular‑Expression Denial of Service (ReDoS) located in the extract_metadata function of the markdown2 Python library. A crafted Markdown document can force the regex engine into worst‑case exponential backtracking, consuming excessive CPU and memory resources. This results in an application or service that processes Markdown halting or becoming unresponsive, thereby disrupting availability only.

The affected software is trentm’s markdown2 library, issue identified in versions up to and including 2.5.5. Any application that imports markdown2 and uses the extract_metadata routine is potentially vulnerable.

With a CVSS score of 5.3, the vulnerability falls into the moderate severity range. The EPSS score of 0.00149 indicates a very low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog, implying no recorded public exploitation to date. The likely attack vector is any user‑supplied Markdown content that triggers the vulnerable extract_metadata routine; an attacker could supply a specially crafted document that forces exponential backtracking in the regular‑expression engine, consuming CPU and memory resources. Successful exploitation would lead to a denial of service by causing the application that parses markdown to become unresponsive or crash, thereby disrupting availability.