CVE-2022-34749: Mistune Catastrophic Backtracking Vulnerability
Summary
CVE-2022-34749: Mistune vulnerable to catastrophic backtracking. Affects mistune versions >= 2.0.0a1, < 2.0.3. Fixed in 2.0.3. How to fix ↓
Also tracked for
- mistune · Debian:11
The same CVE-2022-34749 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mistune is a Python package available on PyPI that provides a markdown parser and renderer. It is commonly used for converting markdown text into HTML. The package is vulnerable to a catastrophic backtracking issue in versions 2.0.0 through 2.0.2. This vulnerability arises from the implementation of inline markup using regular expressions, which can lead to excessive backtracking in certain edge cases. The vulnerability has been assigned a CVSS score of 8.6, indicating a high severity level.
Vulnerability Detail
The Mistune package, specifically versions 2.0.0 through 2.0.2, is susceptible to a catastrophic backtracking vulnerability. This vulnerability occurs when processing inline markup using regular expressions, resulting in excessive backtracking in certain scenarios. The behavior is commonly referred to as catastrophic backtracking and can have severe consequences. An attacker could potentially exploit this vulnerability to cause denial of service (DoS) by providing specially crafted input that triggers the excessive backtracking, leading to high CPU usage and potential system instability.
How To Fix
Latest published version: 3.4.0 as of 22 Oct 2026
pip install --upgrade "mistune==3.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.3
This is the first release that contains the fix.
pip install --upgrade "mistune==2.0.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the latest version is not immediately feasible, developers can consider implementing input validation and sanitization to mitigate the risk of exploitation. By carefully validating and sanitizing user input before processing it with Mistune, the likelihood of encountering the specific input patterns that trigger catastrophic backtracking can be reduced. However, this workaround is not a substitute for upgrading to the fixed version of the package.
Conclusion
The Mistune package versions 2.0.0 through 2.0.2 are vulnerable to a catastrophic backtracking issue, which can be exploited to cause denial of service. To mitigate this vulnerability, it is crucial to upgrade to version 2.0.3 or later of the package. Additionally, implementing input validation and sanitization can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mistune →
FAQ
Mistune is a Python package used for parsing and rendering markdown text into HTML. It provides a convenient way to convert markdown content into a format suitable for rendering on websites or other platforms.
Catastrophic backtracking is a behavior that can occur when processing regular expressions. It happens when the regular expression engine encounters a pattern that can be matched in multiple ways, leading to exponential time complexity and excessive CPU usage. In the case of Mistune, this behavior can be triggered by certain input patterns in the inline markup processing.
The vulnerability in Mistune can be exploited by an attacker to cause denial of service (DoS) by providing specially crafted input. This can result in high CPU usage and potential system instability, impacting the availability and performance of the affected application or system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Pipfile.lock file as input. This allows you to quickly assess the impact of the vulnerability without requiring access to the code or installation.
Yes, this vulnerability has been assigned a CVSS score of 8.6, indicating a high severity level. The CVSS score helps assess the potential impact and severity of a vulnerability, providing a standardized way to evaluate and prioritize remediation efforts.
References
Related vulnerabilities
Recent vulnerabilities recorded for mistune.
