CVE-2026-33079
published 2026-05-06CVE-2026-33079: In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` that allows an attacker…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.48%
38.4th percentile
In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping alternatives that can trigger catastrophic backtracking. In both the double-quoted and single-quoted branches, a backslash followed by punctuation can be matched either as an escaped punctuation sequence or as two ordinary characters, creating an ambiguous pattern inside a repeated group. If an attacker supplies Markdown containing repeated ! sequences with no closing quote, the regex engine explores an exponential number of backtracking paths. This is reachable through normal Markdown parsing of inline links and block link reference definitions. A small crafted input can therefore cause significant CPU consumption and make applications using Mistune unresponsive.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lepture | mistune | — | — |
| mistune_project | mistune | >= 3.0.0a1 < 3.2.1 | 3.2.1 |
| mta | mta-solution-server-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-trustyai-cpu-py312-rhel9 | — | — |
| satellite | iop-advisor-engine-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input
vendor_redhat·2026-05-06·CVSS 8.7
CVE-2026-33079 [HIGH] CWE-1333 mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input
mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input
A flaw was found in Mistune, a Markdown parser. This vulnerability, known as Regular Expression Denial of Service (ReDoS), exists in the `LINK_TITLE_RE` regular expression. A remote attacker can exploit this by providing specially crafted Markdown input, which causes the regular expression engine to engage in catastrophic backtracking. This leads to significant CPU consumption, making applications that use Mistune unresponsive and resulting in a Denial of Service.
Package: mta/mta-solution-server-rhel9 (Migration Toolkit for Applications 8) - Under investigation
Package: rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 (Red Hat OpenShift AI (RHOAI)) - Under investigation
Package: rhoai/odh-p
GHSA
Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input
ghsa·2026-05-06
CVE-2026-33079 [HIGH] CWE-1333 Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input
Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input
### Summary
A ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` allows an attacker who can supply Markdown for parsing to cause denial of service. A crafted 58-byte Markdown document blocks the parser for approximately 6 seconds (measured on Apple M2, Python 3.14.3), with exponential growth per additional byte pair.
### Details
The vulnerable regex is defined in [`src/mistune/helpers.py#L20-L25`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25):
```python
LINK_TITLE_RE = re.compile(
r"[ \t\n]+("
r'"(?:\\' + PUNCTUATION + r'|[^"\x00])*"|' # "title"
r"'(?:\\" + PUNCTUATION + r"|[^'\x00])*'" # 'title'
r")
VulDB
lepture mistune up to 3.2.0 Markdown Parser redos (GHSA-8mp2-v27r-99xp)
vuldb·2026-05-06·CVSS 8.7
CVE-2026-33079 [HIGH] lepture mistune up to 3.2.0 Markdown Parser redos (GHSA-8mp2-v27r-99xp)
A vulnerability was found in lepture mistune up to 3.2.0. It has been declared as problematic. This affects an unknown function of the component Markdown Parser. The manipulation results in inefficient regular expression complexity.
This vulnerability is known as CVE-2026-33079. It is possible to launch the attack remotely. No exploit is available.
No detection rules found.
No public exploits indexed.
Rapid7
Patch Tuesday - May 2026
blogs_rapid7·2026-05-13·CVSS 10.0
CVE-2026-41089 [CRITICAL] Patch Tuesday - May 2026
Microsoft is publishing 137 vulnerabilities on May 2026 Patch Tuesday . Microsoft is not aware of exploitation in the wild or public disclosure for any of these vulnerabilities. So far this month, Microsoft has provided patches to address 133 browser vulnerabilities, which are not included in the Patch Tuesday count above.
## Windows Netlogon: critical RCE
Anyone responsible for securing a domain controller should prioritize remediation of CVE-2026-41089 , which is a critical stack-based buffer overflow in Windows Netlogon with a CVSS v3 base score of 9.8. Exploitation leads to execution in the context of the Netlogon service, so that’s SYSTEM privileges on the domain controller. For most pentesters, that’s the point at which the customer report more or less writes itself. No privileges
Bugzilla
CVE-2026-33079 mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input
bugzilla·2026-05-06·CVSS 8.7
CVE-2026-33079 [HIGH] CVE-2026-33079 mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input
CVE-2026-33079 mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input
In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping alternatives that can trigger catastrophic backtracking. In both the double-quoted and single-quoted branches, a backslash followed by punctuation can be matched either as an escaped punctuation sequence or as two ordinary characters, creating an ambiguous pattern inside a repeated group. If an attacker supplies Markdown containing repeated ! sequences with no closing quote, the regex engine exp
https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xphttps://access.redhat.com/security/cve/CVE-2026-33079https://bugzilla.redhat.com/show_bug.cgi?id=2467298https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xphttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33079.json
2026-05-06
Published