PT-2026-56517

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description Mistune is a Python Markdown parser with renderers and plugins. The Include.parse function joins and normalizes user-supplied include paths without verifying that the result remains within the intend...

PT-2026-56511

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.2.1 Description The render admonition function in src/mistune/directives/admonition.py concatenates the :class: option of the Admonition directive into the HTML class attribute without proper escaping. This allows f...

PT-2026-56510

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description A denial of service issue exists in the default parsing process. Long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in...

PT-2026-56512

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description The safe url filter in src/mistune/renderers/html.py fails to block several legacy or chained URI schemes. While it restricts javascript:, vbscript:, file:, and data:, it allows schemes such as feed:...

PT-2026-56508

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description A flaw in the Python Markdown parser occurs when the strikethrough, mark, or insert plugins scan for matching markers from each possible start position. Specifically, a sequence of closed tilde,...

PT-2026-56513

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description The toc plugin and TableOfContents directive generate heading IDs using predictable toc N values instead of slugifying the heading text. This allows attacker-controlled content with id="toc N" to...

PT-2026-56519

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description A Python Markdown parser with renderers and plugins contains an issue where a Markdown document with numerous repeated or distinct reference-link definitions triggers quadratic work within...

PT-2026-56509

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description The HTMLRenderer.safe url function fails to block percent-encoded javascript URIs. This allows an attacker to use specially crafted Markdown links or images to bypass URL protections and execute...

openSUSE 16 Security Update : python-mistune (openSUSE-SU-2026:21191-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21191-1 advisory. This update for python-mistune fixes the following issue - CVE-2026-49851: potential DoS via quadratic-time parsing in parselinktext bsc1269091. Tenable...

OPENSUSE-SU-2026:11180-1 python311-mistune-3.3.2-1.1 on GA media

These are all security issues fixed in the python311-mistune-3.3.2-1.1 package on the GA media of openSUSE Tumbleweed...

Important Photon OS Security Update - PHSA-2026-5.0-0911

Updates of 'rubygem-nokogiri', 'rubygem-faraday', 'python3-mistune', 'python3-urllib3' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2026-5.0-91-0911

Updates of 'rubygem-faraday', 'python3-urllib3', 'rubygem-nokogiri', 'python3-mistune' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2026-5.0-92-0911

Updates of 'python3-urllib3', 'python3-mistune' packages of Photon OS have been released...

SUSE-SU-2026:22495-1 Security update for python-mistune

This update for python-mistune fixes the following issue - CVE-2026-49851: potential DoS via quadratic-time parsing in parselinktext bsc1269091...

OPENSUSE-SU-2026:21191-1 Security update for python-mistune

This update for python-mistune fixes the following issue - CVE-2026-49851: potential DoS via quadratic-time parsing in parselinktext bsc1269091...

[SECURITY] Fedora 43 Update: python-mistune-3.2.1-1.fc43

The fastest markdown parser in pure Python, inspired by marked...

[SECURITY] Fedora 44 Update: python-mistune-3.2.1-1.fc44

The fastest markdown parser in pure Python, inspired by marked...

Mistune: Potential DoS via quadratic-time parsing in parse_link_text

...

CVE-2026-49851

A flaw was found in Mistune, a Python Markdown parser. A remote attacker can exploit this vulnerability by providing a specially crafted Markdown input containing many consecutive bracket characters. This can lead to excessive CPU usage, causing a denial-of-service DoS condition on the affected...

Linux Distros Unpatched Vulnerability : CVE-2026-49851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear approximately O...