Aller au contenu
en Se connecter
8.7 Élevée

CVE-2026-49851 Mistune is a Python Markdown parser with renderers and plugins

Description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.

Produits et versions touchés

Produit Versions touchées Corrigé en
mistune 3.3 premières → < 3.3.0 3.3.0
Red Hat OpenShift AI (RHOAI) Versions non publiées
Migration Toolkit for Applications 8 Versions non publiées
Red Hat OpenShift Container Platform 4 Versions non publiées
Red Hat Satellite 6 Versions non publiées
Red Hat OpenShift AI 3.4 1787073593 premières → < 1787073593 1787073593

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de mistune

Les 28 CVE de mistune →
CVE-2026-121437 Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU… 8.7 Élevée CVE-2026-121438 Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to… 6.9 Moyenne CVE-2026-115354 Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to… 7.1 Élevée CVE-2026-115355 Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read… 8.7 Élevée
Suivre cette CVE