PT-2022-22315 · Mistune+1 · Mistune+1

Lepture · Published 2022-07-25 · Updated 2025-01-12 · CVE-2022-34749

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mistune versions 2.0.2 and earlier

Description The issue arises from the support of inline markup in Mistune, which utilizes regular expressions. These regular expressions can lead to a high amount of backtracking on certain edge cases, a behavior commonly referred to as catastrophic backtracking.

Recommendations For Mistune versions 2.0.2 and earlier, consider updating to a version that addresses the issue of catastrophic backtracking in regular expressions used for inline markup support. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

AZL-10403

CVE-2022-34749

GHSA-FW3V-X4F2-V673

OPENSUSE-SU-2024:12350-1

OPENSUSE-SU-2024:13453-1

OPENSUSE-SU-2025:14637-1

PYSEC-2022-237

RHSA-2026:2711

RHSA-2026:2769

Affected Products

Debian

Mistune

References · 23

• https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2 · Patch
• https://ubuntu.com/security/CVE-2022-34749 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TQHXITQ2DSBYOILKHXBSBB7PFBPZHF63 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34749 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-34749 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-34749 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fw3v-x4f2-v673 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-237 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQHXITQ2DSBYOILKHXBSBB7PFBPZHF63 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-10403 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14637-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-34749 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-34749 · Vendor Advisory
• https://github.com/lepture/mistune · Note