CVE catalog

CVE-2026-49851

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When

[CVE catalog]

Severity
High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.63% · Oct 25, 2026

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmistunesid3.4.0-1fixed
Debianmistuneforky3.1.4-1vulnerable
Debianmistunetrixie3.1.3-1vulnerable
Debianmistunebookworm2.0.4-1not affected
PyPImistuneNot reported3.3.0fixed
Susepython-mistunelinux enterprise server 16.03.1.3-160000.4.1fixed
Susepython-mistunelinux enterprise server for sap applications 16.03.1.3-160000.4.1fixed
Opensusepython-mistuneleap 16.03.1.3-160000.4.1fixed
Opensusepython-mistunetumbleweed3.3.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmistunesourcesid3.3.4-1not yet assignedNot reported[1141770]
Debianmistunesourceforky(unfixed)not yet assignedNot reported[1141770]
Debianmistunesourcetrixie(unfixed)not yet assignedNot reported[1141770]
DebianmistunesourcebookwormNot affectedunimportantNot reported[1141770]
PyPImistunePyPINot reported3.3.0Not reportedGHSA-QCQ2-496W-V96PNot reported
Susepython-mistunerpmlinux enterprise server 16.03.1.3-160000.4.1Not reportedSUSE-SU-2026:22495-1Not reported
Susepython-mistunerpmlinux enterprise server for sap applications 16.03.1.3-160000.4.1Not reportedSUSE-SU-2026:22495-1Not reported
Opensusepython-mistunerpmleap 16.03.1.3-160000.4.1Not reportedOPENSUSE-SU-2026:21191-1Not reported
Opensusepython-mistunerpmtumbleweed3.3.2-1.1Not reportedOPENSUSE-SU-2026:11180-1Not reported

[Debian bug #1141770]

Notes

[trixie] mistune: Minor issue

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [python3-mistune]Affected

    Source package: [mistune]

    Details (2)

    • 3.1.3-1 · all · trixie

      Affected

      nvd · mistune · debian · 13

    • 3.1.3-1 · all · trixie

      Affected

      nvd · mistune · debian · 13

[openSUSE Tumbleweed]

  • [python313-mistune]Unknown

    Source package: [python-mistune]

    Details (1)

    • 3.3.4-1.1 · noarch · tumbleweed

      Unknown · Fixed: 3.3.2-1.1

      Version impact unknown

      nvd · python-mistune · opensuse · tumbleweed

  • [python314-mistune]Unknown

    Source package: [python-mistune]

    Details (1)

    • 3.3.4-1.1 · noarch · tumbleweed

      Unknown · Fixed: 3.3.2-1.1

      Version impact unknown

      nvd · python-mistune · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [python3-mistune]Not affected

    Source package: [mistune]

    Details (2)

    • 2.0.4-1 · all · bookworm

      Not affected

      nvd · mistune · debian · bookworm

    • 2.0.4-1 · all · bookworm

      Not affected

      nvd · mistune · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]