{"id":"CVE-2026-33441","aliases":["GHSA-95rc-q2rv-9f92","SUSE-SU-2026:21858-1","openSUSE-SU-2026:10761-1","openSUSE-SU-2026:20827-1"],"status":"rejected","title":"Rejected reason: This CVE is a duplicate of another CVE: CVE-2026-33079.","description":"This CVE is a duplicate of another CVE: CVE-2026-33079.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-05-06T20:16:31.473Z","modified":"2026-06-02T18:24:31Z","affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-mistune","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-1.1"}]}],"bundled":3}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33441"},{"url":"https://github.com/advisories/GHSA-95rc-q2rv-9f92"},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621858-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264347","tags":["report"]},{"url":"https://bugzilla.suse.com/1264750","tags":["report"]},{"url":"https://bugzilla.suse.com/1264751","tags":["report"]},{"url":"https://bugzilla.suse.com/1264752","tags":["report"]},{"url":"https://bugzilla.suse.com/1264754","tags":["report"]},{"url":"https://bugzilla.suse.com/1265052","tags":["report"]},{"url":"https://bugzilla.suse.com/1265053","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44899","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-33441","description":"This CVE is a duplicate of another CVE: CVE-2026-33079.","status":"rejected","modified":"2026-05-06T19:28:19.227Z","updated_at":"2026-11-02T14:20:08.009733Z"}],"ghsa":[{"id":"GHSA-95rc-q2rv-9f92","title":"Rejected reason: This CVE is a duplicate of another CVE: CVE-2026-33079.","description":"Rejected reason: This CVE is a duplicate of another CVE: CVE-2026-33079.","status":"published","published":"2026-05-06T21:31:41Z","modified":"2026-05-06T21:31:50Z","updated_at":"2026-11-02T15:07:55.830667Z"}],"nvd":[{"id":"CVE-2026-33441","description":"Rejected reason: This CVE is a duplicate of another CVE: CVE-2026-33079.","status":"rejected","published":"2026-05-06T20:16:31.473Z","modified":"2026-05-06T20:16:31.473Z","updated_at":"2026-11-02T14:12:17.418622Z"}],"osv":[{"id":"openSUSE-SU-2026:10761-1","title":"python311-mistune-3.2.1-1.1 on GA media","description":"These are all security issues fixed in the python311-mistune-3.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-12T00:00:00Z","modified":"2026-05-13T07:45:37.097862Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20827-1","title":"Security update for python-mistune","description":"This update for python-mistune fixes the following issues\n\n- CVE-2026-33079: ReDoS in `LINK_TITLE_RE` can lead to denial of service via a crafted Markdown (bsc#1264347).\n- CVE-2026-33441: processing of malformed reference links can lead to excessive resource consumption and denial of\n  service (bsc#1264752).\n- CVE-2026-44708: improper HTML escaping in the math plugin can lead to XSS (bsc#1264751).\n- CVE-2026-44896: improper escaping in `render_figure` can lead to attribute injection and XSS (bsc#1264754).\n- CVE-2026-44897: improper sanitization of user-controlled input in `HTMLRenderer.heading` can lead to XSS\n  (bsc#1264750).\n- CVE-2026-44898: improper sanitization of user-supplied HTML input in `render_toc_ul` can lead to XSS (bsc#1265052).\n- CVE-2026-44899: improper input verification in Image directive plugin and improper escaping in `render_block_image`\n  can lead to CSS injection (bsc#1265053).\n","status":"published","published":"2026-05-28T12:07:59Z","modified":"2026-05-31T18:24:29.12639701Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21858-1","title":"Security update for python-mistune","description":"This update for python-mistune fixes the following issues\n\n- CVE-2026-33079: ReDoS in `LINK_TITLE_RE` can lead to denial of service via a crafted Markdown (bsc#1264347).\n- CVE-2026-33441: processing of malformed reference links can lead to excessive resource consumption and denial of\n  service (bsc#1264752).\n- CVE-2026-44708: improper HTML escaping in the math plugin can lead to XSS (bsc#1264751).\n- CVE-2026-44896: improper escaping in `render_figure` can lead to attribute injection and XSS (bsc#1264754).\n- CVE-2026-44897: improper sanitization of user-controlled input in `HTMLRenderer.heading` can lead to XSS\n  (bsc#1264750).\n- CVE-2026-44898: improper sanitization of user-supplied HTML input in `render_toc_ul` can lead to XSS (bsc#1265052).\n- CVE-2026-44899: improper input verification in Image directive plugin and improper escaping in `render_block_image`\n  can lead to CSS injection (bsc#1265053).\n","status":"published","published":"2026-05-28T12:08:10Z","modified":"2026-06-02T18:24:31.000026659Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}