CVE-2026-49851
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Jun 24, 2026
CISA due date
—
The record
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | python-mistune | 0 | 3.1.3-160000.4.1 |
| openSUSE:Tumbleweed | python-mistune | 0 | 3.3.2-1.1 |
Related vulnerabilities
- CVE-2026-44897 Mistune is a Python Markdown parser with renderers and plugins. Also affects python-mistune
- CVE-2026-33441 Rejected reason: This CVE is a duplicate of another CVE: CVE-2026-33079. Also affects python-mistune
- CVE-2026-33079 In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial… Also affects python-mistune
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-400
- CVE-2026-83400 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-400
- CVE-2026-112400 Pillow is a Python imaging library. CWE-400
- CVE-2026-111766 markdown-it is a Markdown parser. CWE-400
- CVE-2026-111759 markdown-it is a Markdown parser. CWE-400