https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:58:44 +0000 https://vulnerability.circl.lu/vuln/ghsa-8mp2-v27r-99xp <p><strong>Affected:</strong> PyPI: mistune</p> <p>### Summary</p> <p>A ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` allows an attacker who can supply Markdown for parsing to cause denial of service. A crafted 58-byte Markdown document blocks the parser for approximately 6 seconds (measured on Apple M2, Python 3.14.3), with exponential growth per additional byte pair.</p> <p>### Details</p> <p>The vulnerable regex is defined in [`src/mistune/helpers.py#L20-L25`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25):</p> <p>```python LINK_TITLE_RE = re.compile( r&#34;[ \t\n]+(&#34; r&#39;&#34;(?:\\&#39; + PUNCTUATION + r&#39;|[^&#34;\x00])*&#34;|&#39; # &#34;title&#34; r&#34;&#39;(?:\\&#34; + PUNCTUATION + r&#34;|[^&#39;\x00])*&#39;&#34; # &#39;title&#39; r&#34;)&#34; ) ```</p> <p>The double-quote branch compiles to `&#34;(?:\\[PUNCTUATION]|[^&#34;\x00])*&#34;`. The two alternatives inside `(A|B)*` overlap: a backslash followed by a punctuation character (e.g. `\!`) can be matched by **either** branch — as a 2-character escaped-punctuation sequence `\\!`, or as two individual `[^&#34;\x00]` characters (`\` then `!`). The same ambiguity exists in the single-quoted title branch.</p> <p>When the input contains repeated `\!` pairs with no closing `&#34;`, the regex engine exhaustively backtracks through all 2^N combinations, resulting in **exponential O(2^N) time complexity**.</p> <p>This is reachable through normal Markdown parsing via two code paths: 1. **Inline links**: `[text](url &#34;PAYLOAD)` → [`parse_link()`](https://github.com/lepture/mistune/blob/df23edd60b43b6…</p> <p><strong>Affected:</strong> PyPI: mistune</p> <p>### Summary</p> <p>A ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` allows an attacker who can supply Markdown for parsing to cause denial of service. A crafted 58-byte Markdown document blocks the parser for approximately 6 seconds (measured on Apple M2, Python 3.14.3), with exponential growth per additional byte pair.</p> <p>### Details</p> <p>The vulnerable regex is defined in [`src/mistune/helpers.py#L20-L25`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25):</p> <p>```python LINK_TITLE_RE = re.compile( r&#34;[ \t\n]+(&#34; r&#39;&#34;(?:\\&#39; + PUNCTUATION + r&#39;|[^&#34;\x00])*&#34;|&#39; # &#34;title&#34; r&#34;&#39;(?:\\&#34; + PUNCTUATION + r&#34;|[^&#39;\x00])*&#39;&#34; # &#39;title&#39; r&#34;)&#34; ) ```</p> <p>The double-quote branch compiles to `&#34;(?:\\[PUNCTUATION]|[^&#34;\x00])*&#34;`. The two alternatives inside `(A|B)*` overlap: a backslash followed by a punctuation character (e.g. `\!`) can be matched by **either** branch — as a 2-character escaped-punctuation sequence `\\!`, or as two individual `[^&#34;\x00]` characters (`\` then `!`). The same ambiguity exists in the single-quoted title branch.</p> <p>When the input contains repeated `\!` pairs with no closing `&#34;`, the regex engine exhaustively backtracks through all 2^N combinations, resulting in **exponential O(2^N) time complexity**.</p> <p>This is reachable through normal Markdown parsing via two code paths: 1. **Inline links**: `[text](url &#34;PAYLOAD)` → [`parse_link()`](https://github.com/lepture/mistune/blob/df23edd60b43b6…</p> https://vulnerability.circl.lu/vuln/ghsa-8mp2-v27r-99xp