CVE-2026-33441
Rejected reason: This CVE is a duplicate of another CVE: CVE-2026-33079.
This CVE is a duplicate of another CVE: CVE-2026-33079.
What each source reports
CVE List No score
This CVE is a duplicate of another CVE: CVE-2026-33079.
- Record
CVE-2026-33441- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-95rc-q2rv-9f92 No score
Rejected reason: This CVE is a duplicate of another CVE: CVE-2026-33079.
Rejected reason: This CVE is a duplicate of another CVE: CVE-2026-33079.
- Record
GHSA-95rc-q2rv-9f92- Updated
- 2026-11-02
NVD No score
Rejected reason: This CVE is a duplicate of another CVE: CVE-2026-33079.
- Record
CVE-2026-33441- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10761-1 No score
python311-mistune-3.2.1-1.1 on GA media
These are all security issues fixed in the python311-mistune-3.2.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10761-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20827-1 No score
Security update for python-mistune
This update for python-mistune fixes the following issues
- CVE-2026-33079: ReDoS in
LINK_TITLE_REcan lead to denial of service via a crafted Markdown (bsc#1264347). - CVE-2026-33441: processing of malformed reference links can lead to excessive resource consumption and denial of service (bsc#1264752).
- CVE-2026-44708: improper HTML escaping in the math plugin can lead to XSS (bsc#1264751).
- CVE-2026-44896: improper escaping in
render_figurecan lead to attribute injection and XSS (bsc#1264754). - CVE-2026-44897: improper sanitization of user-controlled input in
HTMLRenderer.headingcan lead to XSS (bsc#1264750). - CVE-2026-44898: improper sanitization of user-supplied HTML input in
render_toc_ulcan lead to XSS (bsc#1265052). - CVE-2026-44899: improper input verification in Image directive plugin and improper escaping in
render_block_imagecan lead to CSS injection (bsc#1265053).
- Record
openSUSE-SU-2026:20827-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21858-1 No score
Security update for python-mistune
This update for python-mistune fixes the following issues
- CVE-2026-33079: ReDoS in
LINK_TITLE_REcan lead to denial of service via a crafted Markdown (bsc#1264347). - CVE-2026-33441: processing of malformed reference links can lead to excessive resource consumption and denial of service (bsc#1264752).
- CVE-2026-44708: improper HTML escaping in the math plugin can lead to XSS (bsc#1264751).
- CVE-2026-44896: improper escaping in
render_figurecan lead to attribute injection and XSS (bsc#1264754). - CVE-2026-44897: improper sanitization of user-controlled input in
HTMLRenderer.headingcan lead to XSS (bsc#1264750). - CVE-2026-44898: improper sanitization of user-supplied HTML input in
render_toc_ulcan lead to XSS (bsc#1265052). - CVE-2026-44899: improper input verification in Image directive plugin and improper escaping in
render_block_imagecan lead to CSS injection (bsc#1265053).
- Record
SUSE-SU-2026:21858-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-mistuneopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 3.2.1-1.1 | 3.2.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-33441 has been rejected by its source and should not be treated as a live vulnerability, published May 6, 2026.
References
nvd.nist.gov/vuln/detail/CVE-2026-33441
github.com/advisories/GHSA-95rc-q2rv-9f92
suse.com/support/update/announcement/2026/suse-su-202621858-1
bugzilla.suse.com/1264347
Show 11 moreShow less