CVE-2026-49851
Full vulnerability record from the local CVENow database.
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-06-24 18:17:18.937000
Last modified
2026-10-25 22:10:00.150000
View original CVE JSON
{
"id": "CVE-2026-49851",
"sourceIdentifier": "[email protected]",
"published": "2026-06-24T18:17:18.937",
"lastModified": "2026-10-25T22:10:00.150",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0."
},
{
"lang": "es",
"value": "Mistune es un analizador de Markdown para Python con renderizadores y complementos. Antes de la 3.3.0, Mistune es vulnerable a un DoS por agotamiento de CPU debido a un comportamiento superlineal (aproximadamente O(n²)) en parse_link_text. Al analizar Markdown que contiene muchos caracteres [ consecutivos, parse_link_text escanea repetidamente la entrada utilizando una búsqueda de expresiones regulares dentro de un bucle. Cada iteración vuelve a escanear una gran parte de la cadena restante, lo que resulta en un comportamiento de tiempo cuadrático. Una entrada de Markdown controlada por un atacante puede, por lo tanto, desencadenar un uso excesivo de la CPU con una carga útil muy pequeña. Esta vulnerabilidad se corrigió en la 3.3.0."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "lepture",
"product": "mistune",
"versions": [
{
"version": "< 3.3.0",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073866",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073936",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073873",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073459",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073611",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073451",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073451",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787076778",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787077779",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787076481",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787074331",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073913",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787074078",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073929",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073605",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073546",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073717",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073713",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787073593",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Migration Toolkit for Applications 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mta/mta-solution-server-rhel9",
"cpes": [
"cpe:/a:redhat:migration_toolkit_applications:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "python-mistune",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Satellite 6",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "satellite/iop-advisor-engine-rhel9",
"cpes": [
"cpe:/a:redhat:satellite:6"
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-25T19:55:32.245725Z",
"id": "CVE-2026-49851",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-400"
},
{
"lang": "en",
"value": "CWE-407"
},
{
"lang": "en",
"value": "CWE-770"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-1333"
}
]
}
],
"references": [
{
"url": "https://github.com/lepture/mistune/security/advisories/GHSA-qcq2-496w-v96p",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60520",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-49851",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492304",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://github.com/lepture/mistune/security/advisories/GHSA-qcq2-496w-v96p",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49851.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}