{"id":"CVE-2026-49851","state":"PUBLISHED","title":"Mistune: Potential DoS via quadratic-time parsing in parse_link_text","description":"Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.","publishedAt":"2026-06-24T17:05:33.602Z","updatedAt":"2026-08-28T12:04:23.106Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["lepture mistune"],"affected":[{"vendor":"lepture","product":"mistune","versions":[{"version":"< 3.3.0","status":"affected"}]}],"references":["https://github.com/lepture/mistune/security/advisories/GHSA-qcq2-496w-v96p","https://access.redhat.com/security/cve/CVE-2026-49851","https://bugzilla.redhat.com/show_bug.cgi?id=2492304","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49851.json","https://access.redhat.com/errata/RHSA-2026:60520"],"weaknesses":["CWE-400","CWE-770","CWE-407","CWE-1333"],"ingestedAt":"2026-10-29T20:12:07.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/49xxx/CVE-2026-49851.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-49851","state":"PUBLISHED","datePublished":"2026-06-24T17:05:33.602Z","dateUpdated":"2026-08-28T12:04:23.106Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-06-01T22:03:19.640Z"},"containers":{"cna":{"title":"Mistune: Potential DoS via quadratic-time parsing in parse_link_text","descriptions":[{"lang":"en","value":"Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0."}],"affected":[{"vendor":"lepture","product":"mistune","versions":[{"version":"< 3.3.0","status":"affected"}]}],"references":[{"url":"https://github.com/lepture/mistune/security/advisories/GHSA-qcq2-496w-v96p","name":"https://github.com/lepture/mistune/security/advisories/GHSA-qcq2-496w-v96p","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","lang":"en","description":"CWE-400: Uncontrolled Resource Consumption","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-770","lang":"en","description":"CWE-770: Allocation of Resources Without Limits or Throttling","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-407","lang":"en","description":"CWE-407: Inefficient Algorithmic Complexity","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-06-24T17:05:33.602Z"},"source":{"advisory":"GHSA-qcq2-496w-v96p","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/lepture/mistune/security/advisories/GHSA-qcq2-496w-v96p","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-25T19:55:32.245725Z","id":"CVE-2026-49851","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-25T19:55:45.423Z"}},{"title":"Mistune: Mistune: Denial of Service via crafted Markdown input","descriptions":[{"lang":"en","value":"A flaw was found in Mistune, a Python Markdown parser. A remote attacker can exploit this vulnerability by providing a specially crafted Markdown input containing many consecutive bracket characters. This can lead to excessive CPU usage, causing a denial-of-service (DoS) condition on the affected system."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073866","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073936","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073873","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073459","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073611","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073451","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073451","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-th06-cpu-torch210-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787076778","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-th06-cuda130-torch210-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787077779","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-th06-rocm64-torch291-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787076481","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787074331","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073913","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787074078","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073929","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073605","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073546","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073717","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073713","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787073593","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Migration Toolkit for Applications 8","packageName":"mta/mta-solution-server-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:migration_toolkit_applications:8"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-th06-cpu-torch291-py312-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-th06-cuda130-torch291-py312-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"python-mistune","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"satellite/iop-advisor-engine-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-49851","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492304","name":"RHBZ#2492304","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49851.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1333","description":"Inefficient Regular Expression Complexity","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-08-28T12:04:23.106Z"},"datePublic":"2026-06-24T17:05:33.602Z","solutions":[{"lang":"en","value":"RHSA-2026:60520: Red Hat OpenShift AI 3.4"}],"timeline":[{"lang":"en","time":"2026-06-24T18:04:13.571Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-06-24T17:05:33.602Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}