GitHub Advisoryadvisory · PyPI

GHSA-fw3v-x4f2-v673 Mistune vulnerable to catastrophic backtracking

HIGH Published 2022-07-26 Modified 2024-09-25 Official page ↗
Aliases
CVE-2022-34749
Ecosystem
PyPI
Packages
mistune
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weaknesses
CWE-1333
Reviewed
2022-07-29

Affected packages

• PyPI mistune: >= 2.0.0a1, < 2.0.3 → fixed in 2.0.3

Description

In Mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.

Related

Alias · CVE (1)

  • CVE-2022-34749 In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References