Cloudanix VulnDB

GHSA-hjph-f4mc-wx4c

High · 7.5

Duplicate Advisory: Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input

CVSS

7.5

EPSS

—

Published

May 6, 2026

CISA due date

—

The record

**Denial-of-Service (DoS)** vulnerability in the Mistune Markdown parser. The issue occurs when processing specially crafted reference links, which can cause excessive parsing and CPU consumption, leading to application hangs. **Function affected:** parse_link_title() in helpers.py **Issue:** Malformed reference links cause excessive backtracking and parsing loops. **Impact:** Remote attackers can submit malicious Markdown to hang processes, causing service unavailability.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities