PT-2026-38261 · Pypi · Mistune

Published 2026-05-06 · Updated 2026-05-12 · CVE-2026-33441

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions mistune versions prior to 3.2.1

Description A Denial-of-Service (DoS) issue exists in the Mistune Markdown parser. Processing specially crafted reference links can cause excessive backtracking and parsing loops within the parse link title() function in helpers.py, leading to excessive CPU consumption and application hangs. Remote attackers can exploit this by submitting malicious Markdown to cause service unavailability.

Recommendations Update to version 3.2.1. As a temporary workaround, consider restricting the use of the parse link title() function or implementing limits on reference-link title length and parsing depth to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-33441

GHSA-HJPH-F4MC-WX4C

OPENSUSE-SU-2026:10761-1

Affected Products

Mistune

References · 7

• https://osv.dev/vulnerability/openSUSE-SU-2026:10761-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hjph-f4mc-wx4c · Vendor Advisory
• https://github.com/lepture/mistune · Note
• https://github.com/lepture/mistune/security/advisories/GHSA-hjph-f4mc-wx4c · Note
• https://suse.com/security/cve/CVE-2026-33079 · Note
• https://suse.com/security/cve/CVE-2026-44897 · Note
• https://suse.com/security/cve/CVE-2026-33441 · Note