CVE-2026-33079

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33079", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T19:27:06.345Z", "datePublished": "2026-05-06T17:25:09.026Z", "dateUpdated": "2026-08-28T12:04:18.949Z"}, "containers": {"cna": {"title": "Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp"}, {"name": "https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25", "tags": ["x_refsource_MISC"], "url": "https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25"}], "affected": [{"vendor": "lepture", "product": "mistune", "versions": [{"version": ">=3.0.0a1, <= 3.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-06T17:25:09.026Z"}, "descriptions": [{"lang": "en", "value": "In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping alternatives that can trigger catastrophic backtracking. In both the double-quoted and single-quoted branches, a backslash followed by punctuation can be matched either as an escaped punctuation sequence or as two ordinary characters, creating an ambiguous pattern inside a repeated group. If an attacker supplies Markdown containing repeated ! sequences with no closing quote, the regex engine explores an exponential number of backtracking paths. This is reachable through normal Markdown parsing of inline links and block link reference definitions. A small crafted input can therefore cause significant CPU consumption and make applications using Mistune unresponsive."}], "source": {"advisory": "GHSA-8mp2-v27r-99xp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-06T19:02:37.046157Z", "id": "CVE-2026-33079", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T19:02:51.759Z"}}, {"affected": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:migration_toolkit_applications:8.2::el9"], "defaultStatus": "affected", "packageName": "mta/mta-solution-server-rhel9", "product": "Red Hat Migration Toolkit for Applications 8.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1784109883", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073866", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073936", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073873", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073459", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073611", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073451", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073451", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787076778", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787077779", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787076481", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787074331", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073913", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787074078", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073929", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073605", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073546", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073717", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073713", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073593", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:satellite:6"], "defaultStatus": "unaffected", "packageName": "satellite/iop-advisor-engine-rhel9", "product": "Red Hat Satellite 6", "vendor": "Red Hat"}], "datePublic": "2026-05-06T17:25:09.026Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Mistune, a Markdown parser. This vulnerability, known as Regular Expression Denial of Service (ReDoS), exists in the `LINK_TITLE_RE` regular expression. A remote attacker can exploit this by providing specially crafted Markdown input, which causes the regular expression engine to engage in catastrophic backtracking. This leads to significant CPU consumption, making applications that use Mistune unresponsive and resulting in a Denial of Service."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "description": "Inefficient Regular Expression Complexity", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-33079"}, {"name": "RHBZ#2467298", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467298"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33079.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:43038"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:60520"}], "solutions": [{"lang": "en", "value": "RHSA-2026:43038: Red Hat Migration Toolkit for Applications 8.2"}, {"lang": "en", "value": "RHSA-2026:60520: Red Hat OpenShift AI 3.4"}], "timeline": [{"lang": "en", "time": "2026-05-06T18:01:13.818Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-06T17:25:09.026Z", "value": "Made public."}], "title": "mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-28T12:04:18.949Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:migration_toolkit_applications:8.2::el9"], "vendor": "Red Hat", "product": "Red Hat Migration Toolkit for Applications 8.2", "versions": [{"status": "unaffected", "version": "1784109883", "lessThan": "*", "versionType": "rpm"}], "packageName": "mta/mta-solution-server-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073866", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073936", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073873", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073459", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073611", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073451", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073451", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787076778", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787077779", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787076481", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787074331", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073913", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787074078", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073929", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073605", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073546", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073717", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073713", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1787073593", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "packageName": "satellite/iop-advisor-engine-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-06T18:01:13.818Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-06T17:25:09.026Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:43038: Red Hat Migration Toolkit for Applications 8.2"}, {"lang": "en", "value": "RHSA-2026:60520: Red Hat OpenShift AI 3.4"}], "x_adpType": "supplier", "datePublic": "2026-05-06T17:25:09.026Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-33079", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467298", "name": "RHBZ#2467298", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33079.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:43038", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60520", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Mistune, a Markdown parser. This vulnerability, known as Regular Expression Denial of Service (ReDoS), exists in the `LINK_TITLE_RE` regular expression. A remote attacker can exploit this by providing specially crafted Markdown input, which causes the regular expression engine to engage in catastrophic backtracking. This leads to significant CPU consumption, making applications that use Mistune unresponsive and resulting in a Denial of Service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-28T12:04:18.949Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33079", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T19:02:37.046157Z"}}}], "references": [{"url": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T19:02:48.489Z"}}], "cna": {"title": "Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles", "source": {"advisory": "GHSA-8mp2-v27r-99xp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "lepture", "product": "mistune", "versions": [{"status": "affected", "version": ">=3.0.0a1, <= 3.2.0"}]}], "references": [{"url": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp", "name": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25", "name": "https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping alternatives that can trigger catastrophic backtracking. In both the double-quoted and single-quoted branches, a backslash followed by punctuation can be matched either as an escaped punctuation sequence or as two ordinary characters, creating an ambiguous pattern inside a repeated group. If an attacker supplies Markdown containing repeated ! sequences with no closing quote, the regex engine explores an exponential number of backtracking paths. This is reachable through normal Markdown parsing of inline links and block link reference definitions. A small crafted input can therefore cause significant CPU consumption and make applications using Mistune unresponsive."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-06T17:25:09.026Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33079", "state": "PUBLISHED", "dateUpdated": "2026-08-28T12:04:18.949Z", "dateReserved": "2026-03-17T19:27:06.345Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-06T17:25:09.026Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mistune", "vendor": "lepture", "versions": [{"status": "affected", "version": ">=3.0.0a1, <= 3.2.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:migration_toolkit_applications:8.2::el9"], "defaultStatus": "affected", "packageName": "mta/mta-solution-server-rhel9", "product": "Red Hat Migration Toolkit for Applications 8.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1784109883", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073866", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073936", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073873", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073459", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073611", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073451", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073451", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787076778", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787077779", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787076481", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787074331", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073913", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787074078", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073929", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073605", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073546", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073717", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073713", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 3.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787073593", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:satellite:6"], "defaultStatus": "unaffected", "packageName": "satellite/iop-advisor-engine-rhel9", "product": "Red Hat Satellite 6", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping alternatives that can trigger catastrophic backtracking. In both the double-quoted and single-quoted branches, a backslash followed by punctuation can be matched either as an escaped punctuation sequence or as two ordinary characters, creating an ambiguous pattern inside a repeated group. If an attacker supplies Markdown containing repeated ! sequences with no closing quote, the regex engine explores an exponential number of backtracking paths. This is reachable through normal Markdown parsing of inline links and block link reference definitions. A small crafted input can therefore cause significant CPU consumption and make applications using Mistune unresponsive."}, {"lang": "es", "value": "En las versiones 3.0.0a1 a 3.2.0 de Mistune, existe una vulnerabilidad ReDoS (denegaci\u00f3n de servicio por expresi\u00f3n regular) en LINK_TITLE_RE que permite a un atacante que puede proporcionar Markdown para su an\u00e1lisis causar una denegaci\u00f3n de servicio. La expresi\u00f3n regular utilizada para analizar t\u00edtulos de enlaces contiene alternativas superpuestas que pueden desencadenar un retroceso catastr\u00f3fico. Tanto en las ramas con comillas dobles como con comillas simples, una barra invertida seguida de puntuaci\u00f3n puede coincidir como una secuencia de puntuaci\u00f3n escapada o como dos caracteres ordinarios, creando un patr\u00f3n ambiguo dentro de un grupo repetido. Si un atacante proporciona Markdown que contiene secuencias repetidas de ! sin comilla de cierre, el motor de expresiones regulares explora un n\u00famero exponencial de rutas de retroceso. Esto es alcanzable a trav\u00e9s del an\u00e1lisis normal de Markdown de enlaces en l\u00ednea y definiciones de referencia de enlaces de bloque. Una peque\u00f1a entrada manipulada puede, por lo tanto, causar un consumo significativo de CPU y hacer que las aplicaciones que usan Mistune no respondan."}], "id": "CVE-2026-33079", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33079", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-06T19:02:37.046157Z", "version": "2.0.3"}}]}, "published": "2026-05-06T18:16:03.097", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25"}, {"source": "security-advisories@github.com", "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:43038"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:60520"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-33079"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467298"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33079.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-1333"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input", "id": "2467298", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467298"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1333", "details": ["A flaw was found in Mistune, a Markdown parser. This vulnerability, known as Regular Expression Denial of Service (ReDoS), exists in the `LINK_TITLE_RE` regular expression. A remote attacker can exploit this by providing specially crafted Markdown input, which causes the regular expression engine to engage in catastrophic backtracking. This leads to significant CPU consumption, making applications that use Mistune unresponsive and resulting in a Denial of Service."], "name": "CVE-2026-33079", "package_state": [{"cpe": "cpe:/a:redhat:migration_toolkit_applications:8", "fix_state": "Under investigation", "package_name": "mta/mta-solution-server-rhel9", "product_name": "Migration Toolkit for Applications 8"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Under investigation", "package_name": "satellite/iop-advisor-engine-rhel9", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-05-06T17:25:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33079\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33079\nhttps://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25\nhttps://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.0.0a1,3.2.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mistune", "source": "cna", "vendor": "lepture"}, "product": "mistune", "vendor": "lepture"}], "created": "2026-05-06T20:45:05.350616+00:00", "updated": "2026-05-07T21:25:30.752077+00:00", "vendors": ["lepture", "lepture$PRODUCT$mistune"]}