{"id":"CVE-2022-34749","title":"In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtrackin","published":"2022-07-25T19:15:07.837Z","updated":"2026-06-17T00:50:51.650Z","severity":"high","cvssScore":7.5,"epss":0.01617,"epssPct":0.76373,"kev":false,"maturity":"none","actionScore":30,"primaryVendor":"mistune project","primaryProduct":"mistune","cweId":"CWE-1333","fixAvailable":true,"tags":["pre-auth","dos","remote","no-ui"],"epssDelta7":0.004,"summary":"In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssVersion":"3.1","cvssSource":"nvd-primary","cweName":"Inefficient Regular Expression Complexity","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-03T09:22:10.438Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T11:00:41.682Z"},"cvssCna":null,"hasPatchRef":true,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"mistune project","product":"mistune","cpe":"cpe:2.3:a:mistune_project:mistune"},{"vendor":"fedoraproject","product":"fedora","cpe":"cpe:2.3:o:fedoraproject:fedora"}],"references":[{"url":"https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2","tags":"Patch,Third Party Advisory"},{"url":"https://github.com/lepture/mistune/releases","tags":"Release Notes,Third Party Advisory"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQHXITQ2DSBYOILKHXBSBB7PFBPZHF63/","tags":null}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"fedoraproject","product":"fedora","version":"37","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"mistune project","product":"mistune","version":"*","vsi":null,"vse":null,"vei":"2.0.2","vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}