Duplicate Advisory: Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8mp2-v27r-99xp. This link is maintained to preserve external references. Original Description Summary Denial-of-Service DoS vulnerability in the Mistune Markdown parser. The issue occurs when processing speciall...

ai-shell (>=0.1.0, <=1.0.4), almax-common (>=0.9.5, <=1.0.2) +137 more potentially affected by CVE-2026-33079 +1 more via mistune (>=3.0.0rc5, <=3.2.0)

mistune PYPI version =3.0.0rc5, =0.1.0, =0.9.5, =3.0.0rc3, =3.2.1b1, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.2, =1.0.0.1, =0.0.1, =0.1.10, =0.26.0, =0.27.0 and more Source cves: CVE-2026-33079, CVE-2026-33441 Source advisory: SNYK:PYTHON-MISTUNE-16438944...

ai-shell (>=0.1.0, <=1.0.4), almax-common (>=0.9.5, <=1.0.2) +137 more potentially affected by CVE-2026-33079 via mistune (>=3.0.0rc5, <=3.2.0)

mistune PYPI version =3.0.0rc5, =0.1.0, =0.9.5, =3.0.0rc3, =3.2.1b1, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.2, =1.0.0.1, =0.0.1, =0.1.10, =0.26.0, =0.27.0 and more Source cves: CVE-2026-33079 Source advisory: OSV:GHSA-8MP2-V27R-99XP...

Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input

Summary A ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE allows an attacker who can supply Markdown for parsing to cause denial of service. A crafted 58-byte Markdown document blocks the parser for approximately 6 seconds measured on Apple M2, Python 3.14.3, with...

ai-shell (>=0.1.0, <=1.0.4), almax-common (>=0.9.5, <=1.0.2) +137 more potentially affected by CVE-2026-33079 via mistune (>=3.0.0rc5, <=3.2.0)

mistune PYPI version =3.0.0rc5, =0.1.0, =0.9.5, =3.0.0rc3, =3.2.1b1, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.2, =1.0.0.1, =0.0.1, =0.1.10, =0.26.0, =0.27.0 and more Source cves: CVE-2026-33079 Source advisory: GHSA-8MP2-V27R-99XP...

GHSA-8MP2-V27R-99XP Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input

Summary A ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE allows an attacker who can supply Markdown for parsing to cause denial of service. A crafted 58-byte Markdown document blocks the parser for approximately 6 seconds measured on Apple M2, Python 3.14.3, with...

EUVD-2026-27877

Mistune has a ReDoS in LINKTITLERE that allows denial of service via crafted Markdown input...

CVE-2026-44897

creationtimestamp| type| source ---|---|--- 2026-05-06 07:13:48+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-v87v-83h2-53w7 2026-08-21 22:43:14+00:00| seen| https://gist.github.com/EbonJaeger/dbd95fac767f33b74282ee64940b0537 2026-08-22...

PT-2026-38261

Name of the Vulnerable Software and Affected Versions mistune versions prior to 3.2.1 Description A Denial-of-Service DoS issue exists in the Mistune Markdown parser. Processing specially crafted reference links can cause excessive backtracking and parsing loops within the parse link title functi...

Mistune security vulnerability

Mistune is a fast and powerful Python Markdown parser developed by Hsiaoming Yang. Versions of Mistune from 3.0.0a1 to 3.2.0 contain security vulnerabilities. These vulnerabilities stem from a denial-of-service attack involving regular expressions in LINKTITLERE, which could allow attackers to...

PT-2026-38088

Name of the Vulnerable Software and Affected Versions Mistune versions 3.0.0a1 through 3.2.0 Description A Regular Expression Denial of Service ReDoS exists in the LINK TITLE RE regular expression. An attacker can provide specially crafted Markdown for parsing that triggers catastrophic...

CVE-2026-33079: Inefficient Regular Expression Complexity

In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping...

mistune: catastrophic backtracking

A regular expression denial of service ReDoS flaw was found in the asteris emphasis regular expression implementation in Mistune. By sending specially-crafted regex input, a remote attacker could invoke a catastrophic backtrack, resulting in a denial of service...

mistune: catastrophic backtracking

A regular expression denial of service ReDoS flaw was found in the asteris emphasis regular expression implementation in Mistune. By sending specially-crafted regex input, a remote attacker could invoke a catastrophic backtrack, resulting in a denial of service...

EUVD-2017-0074

Malware in sbrugna...

EUVD-2017-0075

Malware in sbrugna...

EUVD-2022-0155

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2017-16876

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in the keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HT...

Linux Distros Unpatched Vulnerability : CVE-2017-15612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline such as in java\nscript: or a crafted email address, related to the escape and autolink...

Linux Distros Unpatched Vulnerability : CVE-2022-34749

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge...