CVE-2026-49851

EUVD-2026-39007

24.06.2026, 18:17

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 47.88%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat OpenShift AI 3.4	1787073866 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787073936 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787073873 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787073459 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787073611 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787073451 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787076778 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787077779 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787076481 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787074331 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787073913 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787074078 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787073929 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787073605 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787073546 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787073717 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787073713 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.4	1787073593 ≤ 𝑥 < *	ADP