lepture mistune up to 3.2.0 Markdown Parser redos

Summaryinfo

A vulnerability was found in lepture mistune up to 3.2.0. It has been rated as problematic. This impacts an unknown function of the component Markdown Parser. This manipulation causes redos. This vulnerability is handled as CVE-2026-33079. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic was found in lepture mistune up to 3.2.0. Affected by this vulnerability is an unknown function of the component Markdown Parser. The manipulation with an unknown input leads to a redos vulnerability. The CWE definition for the vulnerability is CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. As an impact it is known to affect availability. The summary by CVE is:

In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping alternatives that can trigger catastrophic backtracking. In both the double-quoted and single-quoted branches, a backslash followed by punctuation can be matched either as an escaped punctuation sequence or as two ordinary characters, creating an ambiguous pattern inside a repeated group. If an attacker supplies Markdown containing repeated ! sequences with no closing quote, the regex engine explores an exponential number of backtracking paths. This is reachable through normal Markdown parsing of inline links and block link reference definitions. A small crafted input can therefore cause significant CPU consumption and make applications using Mistune unresponsive.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-33079 since 03/17/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1449.003 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 313071 (Linux Distros Unpatched Vulnerability : CVE-2026-33079), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (313071). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• lepture

Name

• mistune

Version

• 3.0
• 3.1
• 3.2.0

Website

• Product: https://github.com/lepture/mistune/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion