점검 대응높음KEV 미등록
CVE-2026-49851
lepture mistune, Migration Toolkit for Applications 8, Red Hat OpenShift AI (RHOAI) 취약점
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.
- 대응 우선순위
- 점검
- CVSS
- 8.7
- EPSS
- 0.35% 백분위 27.2% · 2026.07.31 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.06.25