Mistune versions 3.0.0a1 through 3.2.0 contain a ReDoS vulnerability in the LINK_TITLE_RE regular expression. This regex includes overlapping alternatives in both double-quoted and single-quoted branches, where a backslash followed by punctuation can ambiguously match as either an escaped punctuation or two separate characters. This ambiguity inside a repeated group leads to catastrophic backtracking when parsing maliciously crafted Markdown inline links or block link reference definitions. The vulnerability allows an unauthenticated attacker who can supply Markdown input to cause denial of service by exhausting CPU resources.

The vulnerability allows remote attackers to cause denial of service by supplying specially crafted Markdown input that triggers catastrophic backtracking in the regex engine. This results in high CPU usage and can make applications using affected Mistune versions unresponsive. There is no indication of privilege escalation, data disclosure, or code execution from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, avoid processing untrusted Markdown input with affected Mistune versions or implement input validation to restrict potentially malicious patterns that could trigger the ReDoS. Monitor vendor channels for updates and apply official fixes once released.