Is CVE-2026-33079 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33079 being exploited in the wild.

How severe is CVE-2026-33079?

High severity, with a CVSS score of 7.5, published 6 May 2026.

Which products and versions are affected?

mistune (PyPI) ECOSYSTEM:introduced=3.0.0a1,fixed=3.2.1.

Is there a fix for CVE-2026-33079?

Yes. mistune (PyPI): upgrade to 3.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33079 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33079?

Check whether you run mistune (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33079: Mistune ReDoS in LINK_TITLE_RE

CVE-2026-33079 · Severity: high · CVSS 7.5 · Published 2026-05-06

Mistune, a popular Python library for converting Markdown text to HTML, is vulnerable to a denial-of-service attack. By providing a specially crafted, very small Markdown snippet, an attacker can cause the application to consume excessive CPU resources, effectively freezing the service. This can lead to application unresponsiveness for any platform that allows users to submit Markdown content, such as comment sections, documentation portals, or CMS platforms.

Technologies: mistune (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-33079 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33079 being exploited in the wild.
How severe is CVE-2026-33079?: High severity, with a CVSS score of 7.5, published 6 May 2026.
Which products and versions are affected?: mistune (PyPI) ECOSYSTEM:introduced=3.0.0a1,fixed=3.2.1.
Is there a fix for CVE-2026-33079?: Yes. mistune (PyPI): upgrade to 3.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33079 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33079?: Check whether you run mistune (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mistune (PyPI): upgrade to 3.2.1 or later
```
pip install "mistune>=3.2.1"
```

Technical details

A Regular Expression Denial of Service (ReDoS) exists in Mistune's `LINK_TITLE_RE` component due to overlapping alternatives in the regex pattern used for parsing link titles. Specifically, the regex allows a backslash followed by punctuation to be matched in two different ways (as an escaped sequence or as two individual characters), creating ambiguity within a repeated group. When an attacker provides a Markdown string with repeated backslash-punctuation pairs (e.g., `\!`) without a closing quote, the regex engine performs exponential backtracking (O(2^N)). This is reachable via both inline links and block link reference definitions. A payload as small as 58 bytes can block the parser for several seconds. No patch was officially listed as released in the advisory, though a fix involving excluding the backslash from the catch-all character class was suggested.

Affected products

lepture mistune >=3.0.0a1, <= 3.2.0
Red Hat Migration Toolkit for Applications 8
Red Hat Red Hat OpenShift AI (RHOAI)
Red Hat Red Hat Satellite 6

Identifiers

CVE-2026-33079
GHSA-8mp2-v27r-99xp
PYSEC-2026-2651

Timeline

2026-05-06: disclosed
2026-05-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.