{
  "ticket_id": "CVE-2026-33079",
  "code_root": "external/mistune",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-33079",
    "advisory_id": "GHSA-8mp2-v27r-99xp",
    "advisory_url": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp",
    "vendor": "lepture",
    "product": "mistune",
    "repo": "https://github.com/lepture/mistune"
  },
  "facts": {
    "cve_id": "CVE-2026-33079",
    "advisory_id": "GHSA-8mp2-v27r-99xp",
    "issue_summary": "ReDoS in mistune. The LINK_TITLE_RE regular expression contains overlapping alternatives (an escaped-punctuation branch versus a two-ordinary-character branch) inside a repeated group. A Markdown document with a run of repeated '!' characters and no closing quote drives catastrophic backtracking, with cost roughly exponential in the input length.",
    "vulnerability_type": "Inefficient Regular Expression Complexity (ReDoS)",
    "suspected_cwe": ["CWE-1333"],
    "affected_versions": "3.0.0a1 - 3.2.0",
    "fixed_versions": ["3.2.1"],
    "reproduce_version": "3.2.0",
    "verify_fixed_version": "3.2.1",
    "repo_url": "https://github.com/lepture/mistune.git",
    "code_root": "external/mistune",
    "ecosystem": "pypi",
    "package": "mistune",
    "affected_functions": ["LINK_TITLE_RE"],
    "install_recipe": "In a fresh virtualenv run `pip install mistune==3.2.0` (vulnerable) or `pip install mistune==3.2.1` (fixed). The published PyPI wheel is the canonical artifact; git tags v3.2.0 / v3.2.1 on the repo are equivalent.",
    "attacker_access": "Any code path that renders attacker-supplied Markdown through mistune (e.g. user-submitted comments or documents).",
    "exploit_outline": "Render a small crafted Markdown document (about 58 bytes) containing a run of repeated '!' characters with no closing quote, so that LINK_TITLE_RE backtracks catastrophically.",
    "vulnerable_indicator": "Rendering the crafted document hangs: wall-clock time exceeds a generous timeout (e.g. >5s).",
    "fixed_indicator": "In 3.2.1 rendering the same document returns near-instantly (well under the timeout).",
    "reproduction_requirements": "Python (any maintained version) plus the mistune package at the specified version. No network service, database, or browser required - the difference is observable purely in-process by measuring wall-clock render time under a timeout.",
    "notes": "Do not invent specific version numbers or commit hashes beyond those stated here. The Pruva repro agent reads the patch diff itself (git diff v3.2.0..v3.2.1) to confirm the root cause and the regex fix. Wrap the vulnerable render in a hard timeout so the PoC terminates."
  }
}