High severity · published May 6, 2026
CVE-2026-33079
Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping alternatives that can trigger catastrophic backtracking. In both the double-quoted and single-quoted branches, a backslash followed by punctuation can be matched either as an escaped punctuation sequence or as two ordinary characters, creating an ambiguous pattern inside a repeated group. If an attacker supplies Markdown containing repeated ! sequences with no closing quote, the regex engine explores an exponential number of backtracking paths. This is reachable through normal Markdown parsing of inline links and block link reference definitions. A small crafted input can therefore cause significant CPU consumption and make applications using Mistune unresponsive.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
mistune · lepture
>=3.0.0a1, <= 3.2.0 · source: vendor
RH
Red Hat Migration Toolkit for Applications 8.2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI (RHOAI) · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI 3.4 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33079
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33079
github.com
https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25
github.com
https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:43038
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:60520
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-33079
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2467298
More from mistune
8.6
CVE-2026-115353
Mistune before 3.3.0 Path Traversal via include Directive
7.5
CVE-2026-115355
Mistune before 3.3.0 Path Traversal and XSS via Include Directive
7.5
CVE-2026-115352
Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
7.5
CVE-2026-115349
Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
7.5
CVE-2026-115348
Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text
