Skip to content
OpenAdvisories
High · 8.7 CVE-2026-49851 EUVD-2026-39007GHSA-qcq2-496w-v96pPYSEC-2026-2652

Mistune: Potential DoS via quadratic-time parsing in parse_link_text

Published Jun 24, 2026 · Updated Aug 28, 2026 · Assigned by GitHub_M

Description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.

Affected products

VendorProductAffectedFixed
lepture mistune < 3.3.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 mistune No fix yet —
Debian 13 mistune No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 mistune No fix yet —
Ubuntu 26.04 LTS mistune No fix yet —
Ubuntu 25.10 mistune No fix yet —
Ubuntu 24.04 LTS mistune No fix yet —
Ubuntu 22.04 LTS mistune No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS mistune No fix yet —
Ubuntu 18.04 LTS mistune No fix yet —
Ubuntu 16.04 LTS mistune No fix yet —
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 python-mistune 3.1.3-160000.4.1 SUSE-SU-2026:22495-1
SLES 16.0 python-mistune 3.1.3-160000.4.1 SUSE-SU-2026:22495-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-mistune 3.3.2-1.1 openSUSE-SU-2026:11180-1
openSUSE Leap 16.0 python-mistune 3.1.3-160000.4.1 openSUSE-SU-2026:21191-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-mistune 3.3.0-1 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling jupyter-base-notebook 7.6.0-r1 —
Wolfi rolling kubeflow-pipelines-visualization-server 2.16.1-r8 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI mistune < 3.3.0 3.3.0 GHSA-qcq2-496w-v96p

Advisories 3

References