CVE-2022-34749: mistune - Catastrophic Backtracking Vulnerability
Summary
CVE-2022-34749: In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. Affects mistune across 2 version ranges.
>= 2.0.0a1, < 2.0.3
< a6d43215132fe4f3d93f8d7e90ba83b16a0838b2
Fixed in a6d43215132fe4f3d93f8d7e90ba83b16a0838b2. How to fix ↓
Also tracked for
- mistune · Debian:11
The same CVE-2022-34749 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mistune is a Python package available on PyPI that provides a fast yet powerful Markdown parser. It is commonly used to convert Markdown text into HTML. The package is widely adopted and utilized in various applications and frameworks. However, versions up to 2.0.2 are affected by a vulnerability known as catastrophic backtracking.
Vulnerability Detail
The vulnerability in mistune arises due to the implementation of inline markup using regular expressions. In certain edge cases, these regular expressions can result in a high amount of backtracking, leading to a performance issue known as catastrophic backtracking. An attacker could potentially exploit this vulnerability to cause denial of service (DoS) attacks by providing specially crafted input that triggers the backtracking behavior. This could result in excessive CPU and memory usage, leading to the unresponsiveness of the affected application.
How To Fix
Latest published version: 3.4.0 as of 22 Oct 2026
pip install --upgrade "mistune==3.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
a6d43215132fe4f3d93f8d7e90ba83b16a0838b2
This is the first release that contains the fix.
pip install --upgrade "mistune==a6d43215132fe4f3d93f8d7e90ba83b16a0838b2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of mistune to mitigate the risk of exploitation.
Conclusion
The mistune package up to version 2.0.2 is vulnerable to a catastrophic backtracking issue. This vulnerability could be exploited to cause denial of service (DoS) attacks. It is highly recommended to upgrade to mistune version 2.0.3 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mistune →
FAQ
mistune is a Python package that provides a Markdown parser used to convert Markdown text into HTML. It is widely used in various applications and frameworks.
Catastrophic backtracking is a performance issue that occurs when a regular expression involves a high amount of backtracking, leading to excessive CPU and memory usage. It can be exploited by attackers to cause denial of service (DoS) attacks.
The vulnerability in mistune could allow an attacker to trigger excessive CPU and memory usage, leading to the unresponsiveness of the affected application. This could result in denial of service (DoS) attacks.
To fix this vulnerability, it is recommended to upgrade to mistune version 2.0.3 or later. This can be done by running the command 'pip install --upgrade mistune'.
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of mistune to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for mistune.
