CVE-2026-59925

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/lepture/mistune/commit/5de41fb8e527004dbc363e047a3c380c9288c74f	Patch
https://github.com/lepture/mistune/releases/tag/v3.3.0	Release Notes
https://github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Mistune es un analizador de Markdown en Python con renderizadores y complementos. Antes de la 3.3.0, largas secuencias de pares de énfasis bien formados de doble asterisco o triple asterisco alrededor de un carácter causaban un trabajo cuadrático en src/mistune/inline_parser.py porque el analizador busca hacia adelante marcadores de cierre coincidentes desde cada posible secuencia de apertura, lo que permite la denegación de servicio en el análisis predeterminado de Mistune. Este problema se solucionó en la versión 3.3.0.

Information

Published : 2026-07-08 17:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-59925

Mitre link : CVE-2026-59925

CVE.ORG link : CVE-2026-59925

JSON object : View

Products Affected

mistune_project

mistune

CWE

CWE-407

Inefficient Algorithmic Complexity

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2026-59925", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59925", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T19:44:41.353822Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lepture", "product": "mistune", "versions": [{"status": "affected", "version": "< 3.3.0"}]}]}], "published": "2026-07-08T17:17:28.183", "references": [{"url": "https://github.com/lepture/mistune/commit/5de41fb8e527004dbc363e047a3c380c9288c74f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lepture/mistune/releases/tag/v3.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-407"}, {"lang": "en", "value": "CWE-1333"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0."}, {"lang": "es", "value": "Mistune es un analizador de Markdown en Python con renderizadores y complementos. Antes de la 3.3.0, largas secuencias de pares de \u00e9nfasis bien formados de doble asterisco o triple asterisco alrededor de un car\u00e1cter causaban un trabajo cuadr\u00e1tico en src/mistune/inline_parser.py porque el analizador busca hacia adelante marcadores de cierre coincidentes desde cada posible secuencia de apertura, lo que permite la denegaci\u00f3n de servicio en el an\u00e1lisis predeterminado de Mistune. Este problema se solucion\u00f3 en la versi\u00f3n 3.3.0."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63E1B933-D2E2-44EF-A56C-94483300845B", "versionEndExcluding": "3.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}