Homepage

Resource Exhaustion The advisory has been revoked - it doesn't affect any version of package mistune  (opens in a new tab)

Threat Intelligence

EPSS
0.52% (44th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-MISTUNE-17446553
  • published25 Jun 2026
  • disclosed24 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 24 Jun 2026

CVE-2026-49851  (opens in a new tab)
CWE-400  (opens in a new tab)
CWE-407  (opens in a new tab)
CWE-770  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:12.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mistune package and not the mistune package as distributed by Debian.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.