CVE-2026-33079 is a ReDoS vulnerability in the Mistune Markdown parser affecting versions 3.0.0a1 through 3.2.0. The issue is in the LINK_TITLE_RE regular expression, which contains overlapping alternatives allowing ambiguous matching of backslash-punctuation sequences. This ambiguity inside a repeated group leads to catastrophic backtracking when parsing specially crafted Markdown inputs, such as repeated exclamation marks without a closing quote. This vulnerability can be exploited by an unauthenticated attacker supplying Markdown content to cause denial of service by exhausting CPU resources.

The vulnerability allows remote attackers to cause denial of service by supplying crafted Markdown input that triggers exponential backtracking in the vulnerable regex. This results in high CPU usage and unresponsiveness in applications using affected Mistune versions. There is no indication of privilege escalation, data disclosure, or other impacts beyond denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not explicitly confirm a fix or provide a patch for Mistune itself. Users should monitor the vendor advisory for updates and consider mitigating exposure by restricting untrusted Markdown input or applying any official patches once available.