Skip to content
OpenAdvisories
High · 8.7 CVE-2026-33079 EUVD-2026-27877GHSA-8mp2-v27r-99xpPYSEC-2026-2651

Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles

Published May 6, 2026 · Updated Aug 28, 2026 · Assigned by GitHub_M

Description

In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping alternatives that can trigger catastrophic backtracking. In both the double-quoted and single-quoted branches, a backslash followed by punctuation can be matched either as an escaped punctuation sequence or as two ordinary characters, creating an ambiguous pattern inside a repeated group. If an attacker supplies Markdown containing repeated ! sequences with no closing quote, the regex engine explores an exponential number of backtracking paths. This is reachable through normal Markdown parsing of inline links and block link reference definitions. A small crafted input can therefore cause significant CPU consumption and make applications using Mistune unresponsive.

Affected products

VendorProductAffectedFixed
lepture mistune >=3.0.0a1, <= 3.2.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 mistune No fix yet —
Debian 13 mistune No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 mistune No fix yet —
Ubuntu 26.04 LTS mistune No fix yet —
Ubuntu 25.10 mistune No fix yet —
Ubuntu 24.04 LTS mistune No fix yet —
Ubuntu 20.04 LTS mistune No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS mistune No fix yet —
Ubuntu 16.04 LTS mistune No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-mistune 3.2.1-1.1 openSUSE-SU-2026:10761-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-mistune 3.2.1-1 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling kubeflow-pipelines-visualization-server 2.16.1-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI mistune >= 3.0.0a1, < 3.2.1 3.2.1 GHSA-8mp2-v27r-99xp

Advisories 1

References