Описание
In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
A regular expression denial of service (ReDoS) flaw was found in the asteris emphasis regular expression implementation in Mistune. By sending specially-crafted regex input, a remote attacker could invoke a catastrophic backtrack, resulting in a denial of service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 6 | python-mistune | Will not fix | ||
| Red Hat OpenShift Container Platform 4 | python-mistune | Affected | ||
| Red Hat Ceph Storage 7.1 | ceph | Fixed | RHSA-2026:2769 | 17.02.2026 |
| Red Hat Ceph Storage 8.1 | ceph | Fixed | RHSA-2026:2711 | 16.02.2026 |
| Red Hat Ceph Storage 8 | rhceph/rhceph-8-rhel9 | Fixed | RHSA-2026:2737 | 16.02.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
In mistune through 2.0.2 support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
In mistune through 2.0.2, support of inline markup is implemented by u ...
EPSS
7.5 High
CVSS3