CVE-2026-76098

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/lepture/mistune/commit/0938fb7
https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq
https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Mistune es un analizador de Markdown para Python con renderizadores y complementos. Las versiones 3.3.0 a 3.3.2 son vulnerables a DoS a través de tokens profundamente anidados. La renderización HTML crea tokens de énfasis profundamente anidados a partir de caracteres de asterisco consecutivos, y la renderización recursiva en HTMLRenderer.render_token() puede exceder el límite de recursión de Python y generar un RecursionError, permitiendo que un Markdown manipulado bloquee un proceso de análisis. Este problema está solucionado en la versión 3.3.3

Information

Published : 2026-08-24 20:17

Updated : 2026-10-12 15:10

NVD link : CVE-2026-76098

Mitre link : CVE-2026-76098

CVE.ORG link : CVE-2026-76098

JSON object : View

Products Affected

No product.

CWE

CWE-674

Uncontrolled Recursion

{"id": "CVE-2026-76098", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76098", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T20:16:30.617465Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lepture", "product": "mistune", "versions": [{"status": "affected", "version": ">= 3.3.0, < 3.3.3"}]}]}], "published": "2026-08-24T20:17:19.330", "references": [{"url": "https://github.com/lepture/mistune/commit/0938fb7", "source": "security-advisories@github.com"}, {"url": "https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq", "source": "security-advisories@github.com"}, {"url": "https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3"}, {"lang": "es", "value": "Mistune es un analizador de Markdown para Python con renderizadores y complementos. Las versiones 3.3.0 a 3.3.2 son vulnerables a DoS a trav\u00e9s de tokens profundamente anidados. La renderizaci\u00f3n HTML crea tokens de \u00e9nfasis profundamente anidados a partir de caracteres de asterisco consecutivos, y la renderizaci\u00f3n recursiva en HTMLRenderer.render_token() puede exceder el l\u00edmite de recursi\u00f3n de Python y generar un RecursionError, permitiendo que un Markdown manipulado bloquee un proceso de an\u00e1lisis. Este problema est\u00e1 solucionado en la versi\u00f3n 3.3.3"}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "security-advisories@github.com"}