diff --git a/Doc/conf.py b/Doc/conf.py
index 7554b64e3cc4102..2ce143240e31d8d 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -24,6 +24,7 @@
     'pyspecific',
     'sphinx.ext.coverage',
     'sphinx.ext.doctest',
+    'sphinx.ext.extlinks',
 ]
 
 # Skip if downstream redistributors haven't installed it
@@ -500,6 +501,11 @@
 refcount_file = 'data/refcounts.dat'
 stable_abi_file = 'data/stable_abi.dat'
 
+# sphinx.ext.extlinks config
+extlinks = {
+    'cve': ('https://www.cve.org/CVERecord?id=CVE-%s', 'CVE-%s'),
+}
+
 # sphinxext-opengraph config
 ogp_site_url = 'https://docs.python.org/3/'
 ogp_site_name = 'Python documentation'
diff --git a/Doc/tools/extensions/pyspecific.py b/Doc/tools/extensions/pyspecific.py
index c71ad641d7c07b4..80982d566513b18 100644
--- a/Doc/tools/extensions/pyspecific.py
+++ b/Doc/tools/extensions/pyspecific.py
@@ -496,6 +496,7 @@ def run(self):
 
 issue_re = re.compile('(?:[Ii]ssue #|bpo-)([0-9]+)', re.I)
 gh_issue_re = re.compile('(?:gh-issue-|gh-)([0-9]+)', re.I)
+cve_re = re.compile('CVE-([0-9]{4}-[0-9]{4,})', re.I)
 whatsnew_re = re.compile(r"(?im)^what's new in (.*?)\??$")
 
 
@@ -525,6 +526,7 @@ def run(self):
         content = issue_re.sub(r':issue:`\1`', content)
         # Fallback handling for the GitHub issue
         content = gh_issue_re.sub(r':gh:`\1`', content)
+        content = cve_re.sub(r':cve:`\1`', content)
         content = whatsnew_re.sub(r'\1', content)
         # remove first 3 lines as they are the main heading
         lines = ['.. default-role:: obj', ''] + content.splitlines()[3:]