
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2022-34749 affects mistune through version 2.0.2, a markdown parser library. The vulnerability was discovered in July 2022 and involves the implementation of inline markup support using regular expressions that can lead to catastrophic backtracking in certain edge cases (NVD).
The vulnerability stems from the implementation of inline markup support using regular expressions that can trigger high amounts of backtracking when processing certain edge cases. This issue is specifically related to the asterisk emphasis regex implementation. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a high severity issue with potential availability impacts (NVD).
The primary impact of this vulnerability is on system availability. When exploited, the catastrophic backtracking in the regular expression processing can lead to denial of service conditions by consuming excessive system resources (NVD).
The vulnerability has been fixed in version 2.0.3 of mistune. Users should upgrade to this or a later version to address the security issue. The fix specifically addresses the asterisk emphasis regex implementation (GitHub Release, GitHub Patch).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."