PyPI/mistune CVE-2026-33079: high 7.5, EPSS 0.59%

Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input

Action: Upgrade mistune to 3.2.1 or later.

pip install mistune==3.2.1

Affected

Fixed versions

Sources

• osv: GHSA-8mp2-v27r-99xp
• nvd: CVE-2026-33079
• https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp
• https://github.com/lepture/mistune
• https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25

CVE-2026-33079 · published 2026-05-06T16:52:43Z · modified 2026-09-10T03:51:05.039110483Z · JSON