ReDoS Vulnerability in Mistune Affecting Multiple Versions
CVE-2026-33079

8.7HIGH

Key Information:

Vendor

Lepture

Status
Mistune
Vendor
CVE Published:
6 May 2026

What is CVE-2026-33079?

In versions 3.0.0a1 through 3.2.0 of Mistune, a Regular Expression Denial of Service (ReDoS) vulnerability exists due to the regex pattern in the LINK_TITLE_RE function. This vulnerability allows attackers to exploit the Markdown parsing process by submitting specially crafted link titles that trigger catastrophic backtracking in the regex engine. Overlapping alternatives in the regex pattern create ambiguity, leading to significant CPU consumption and rendering applications utilizing Mistune unresponsive. The issue can be exploited through normal Markdown parsing, particularly when providing inline links and block link reference definitions. Proper input validation and careful regex optimization are essential to mitigate this vulnerability.

Affected Version(s)

mistune >=3.0.0a1, <= 3.2.0

References

https://github.com/lepture/mistune/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/lepture/mistune/blob/df23edd60b43b639d...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.