SUSE-SU-2026:21858-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-202621858-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21858-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:21858-1
Upstream
CVE (7)
Related
CVE (7)
Published
2026-05-28T12:08:10Z
Modified
2026-06-02T18:24:31Z
Summary
Security update for python-mistune
Details

This update for python-mistune fixes the following issues

  • CVE-2026-33079: ReDoS in LINK_TITLE_RE can lead to denial of service via a crafted Markdown (bsc#1264347).
  • CVE-2026-33441: processing of malformed reference links can lead to excessive resource consumption and denial of service (bsc#1264752).
  • CVE-2026-44708: improper HTML escaping in the math plugin can lead to XSS (bsc#1264751).
  • CVE-2026-44896: improper escaping in render_figure can lead to attribute injection and XSS (bsc#1264754).
  • CVE-2026-44897: improper sanitization of user-controlled input in HTMLRenderer.heading can lead to XSS (bsc#1264750).
  • CVE-2026-44898: improper sanitization of user-supplied HTML input in render_toc_ul can lead to XSS (bsc#1265052).
  • CVE-2026-44899: improper input verification in Image directive plugin and improper escaping in render_block_image can lead to CSS injection (bsc#1265053).
References

Affected packages