Mistune CVE-2026-121437

The only prerequisite is that the target application passes attacker-controlled input to mistune's markdown renderer and version is >=3.3.0 and <3.3.4; the advisory shows it triggers with the DEFAULT renderer and NO plugins via mistune.create_markdown(). No authentication, no user interaction, and no non-default configuration are required (PR:N/UI:N). Limiting factors for defenders: exploitation requires an exposed code path that renders untrusted markdown synchronously in a request worker, and there must be no upstream input-size cap - the built-in max_emphasis_depth setting does NOT limit this because it caps produced-node depth and is checked after the costly fix-up loop. Impact is CPU exhaustion only (worker stall), not code execution or data access.

This is a genuine, easily-triggered availability risk rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) shows remote, low-complexity, unauthenticated triggering with no user interaction, and impact is strictly availability (VA:H; VC:N/VI:N - no data exposure or tampering), consistent with the CWE-407/CWE-400 algorithmic-complexity DoS. The vendor advisory includes a working proof-of-concept that was reproduced against the 3.3.3 tag and verified fixed in 3.3.4, so exploitability is well established; however there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active in-the-wild exploitation, and widespread opportunistic exploitation cannot be inferred. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning the signals: a confirmed, cheap-to-trigger worker-stall DoS that warrants prompt patching but is availability-only. One nuance worth verifying operationally: impact is per-request worker stall (64KB → ~8s; the '*a**b' variant 80KB → ~20.9s), so real-world severity scales with how exposed and how concurrent the affected markdown-rendering endpoint is; the advisory also notes the existing max_emphasis_depth cap does NOT mitigate this, as it bounds node depth checked after the fix-up work.

An application that renders untrusted user-supplied markdown through mistune's default renderer (e.g. comments, wiki pages, chat or document previews) exposes an unauthenticated endpoint. An attacker submits a single small document of repeated '*a_b' patterns (e.g. 16-64KB), driving the O(n²) emphasis-delimiter index-fixup loop and pinning the request worker for seconds per request; repeated requests exhaust worker capacity and deny service. A working Python PoC is published in the GHSA advisory and was verified against the 3.3.3 release.