Skip to main content

Mistune CVE-2026-59922

| EUVDEUVD-2026-42329 HIGH
Inefficient Algorithmic Complexity (CWE-407)
2026-07-08 GitHub_M GHSA-c8j7-8cv4-2xmq PYSEC-2026-2210
Denial Of Service Python Red Hat Suse Mistune Lepture
7.5
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach Markdown rendering endpoint
  2. Delivery
    Craft dense ~~/==/^^ marker-pair run
  3. Exploit
    Submit as untrusted Markdown input
  4. Execution
    Trigger O(n^2) scan in formatting plugin
  5. Persist
    Exhaust CPU core
  6. Impact
    Repeat to deny service

Vulnerability Assessment

Weakness
CWE
CWE-407
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
Exploitation Conditions

Exploitation requires that the target application (1) parses attacker-supplied Markdown through Mistune at a version below 3.3.0, and (2) has at least one of the strikethrough (~~), mark (==), or insert (^^) formatting plugins enabled - these plugins contain the vulnerable per-start-position scan. The trigger payload is a run of closed tilde, equals-sign, or caret marker pairs around a character. Limiting factors: if none of those three plugins are registered, the vulnerable code path is not reached; impact is confined to availability (CPU exhaustion) with no confidentiality or integrity effect; and input-length limits or parse timeouts already deployed by the application blunt the quadratic amplification.
Impact

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable, unauthenticated, low-complexity availability-only impact - consistent with an algorithmic-complexity DoS. There is no EPSS score, KEV entry, or POC provided in the input, so exploitation likelihood cannot be quantified from external signals; the risk assessment rests on the CVSS vector and description alone. The practical risk is real but conditional: an attacker needs an application that (a) passes attacker-controlled Markdown to Mistune and (b) has the strikethrough, mark, or insert plugin enabled. Where those conditions hold (e.g., user comments, wiki/forum rendering), a single small malicious payload can pin a CPU core with no authentication, making this a genuine priority for exposed rendering services. Where those plugins are not enabled, real-world exploitability drops sharply despite the high base score. Note the description implies a non-default plugin dependency that the CVSS PR:N/AC:L vector does not capture - verify plugin configuration before prioritizing.
Exploit ScenarioDerived

An attacker submits a comment, wiki edit, or API payload containing a long run of closed tilde/equals/caret marker pairs (e.g., many ~~ or == sequences around characters) to a web application that renders user Markdown with Mistune's strikethrough, mark, or insert plugin enabled. The quadratic scan consumes a full CPU core for that request; repeating the submission across connections exhausts server CPU and denies service to legitimate users. No authentication or user interaction is required, and no public POC is currently identified.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

Denial of service in Mistune, a Python Markdown parser, affects all versions prior to 3.3.0 when the strikethrough, mark, or insert plugins are enabled. Remote attackers can submit crafted Markdown containing runs of closed tilde (~), equals (=), or caret (^) marker pairs that trigger quadratic-time scanning in the formatting plugin, exhausting CPU and rendering the parsing service unresponsive. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; impact is limited to availability with no data exposure.

RemediationAI

Vendor-released patch: upgrade Mistune to version 3.3.0 or later, which fixes the quadratic scanning in src/mistune/plugins/formatting.py (fix commit 96d0f57f8fe9eeb06bb4cff521962a27d7c402e7, release https://github.com/lepture/mistune/releases/tag/v3.3.0). Review the advisory at https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq. If immediate upgrade is not possible, the most direct compensating control is to disable the strikethrough, mark, and insert plugins in the Mistune configuration for any pipeline that processes untrusted input - the trade-off is loss of ~~, ==, and ^^ rendering for legitimate users. Additional mitigations: enforce a strict maximum input length on Markdown submitted to the parser (caps the n^2 blow-up but may truncate legitimate long documents), and run parsing under a per-request CPU/time budget or worker timeout so a single malicious payload cannot monopolize a core (adds latency-handling complexity but preserves service availability).

Affected VersionsENISA

mistune < 3.3.0

Affected Packages

pypi mistune fix: 3.3.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Mistune (PyPI package 'mistune', maintained by lepture) is a pure-Python Markdown-to-HTML/AST parser widely embedded in web apps, documentation tooling, and notebook renderers. The root cause is CWE-407 (Inefficient Algorithmic Complexity): in src/mistune/plugins/formatting.py, the strikethrough (~~), mark (==), and insert (^^) plugins scan for a matching closing marker from each possible start position. When the input contains a dense run of closed marker pairs around a character, this per-start-position scan produces O(n^2) work relative to input length. The affected component is the inline formatting plugin layer, so exposure depends on which plugins the embedding application registers rather than on Mistune's core Markdown grammar. CPE cpe:2.3:a:lepture:mistune:*:*:*:* confirms the vendor/product with all versions below the fix in scope.

Know when Mistune gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Untrusted Markdown is typically reachable remotely without auth (AV:N/PR:N/UI:N) and the payload is trivial to craft (AC:L); availability-only impact yields A:H, C:N, I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat 6.5 MEDIUM

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Patch available
Jul 08, 2026 - 18:02 EUVD

DescriptionCVE.org

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 pypi packages depend on mistune (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.3.0.

Articles & Coverage 1

News 10 New Python Vulnerabilities - 2 Critical, 8 High, 1 With POC Jul 09, 2026

Executive ViewAI

Why It Matters

Mistune, a Python Markdown parser used in content processing pipelines, contains a denial-of-service vulnerability affecting applications with strikethrough, mark, or insert plugins enabled. Remote attackers can trigger quadratic-time processing by submitting crafted Markdown, exhausting server CPU and rendering parsing services unresponsive, directly impacting service availability.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Deploy interim mitigations: implement strict input filtering to block runs of marker characters exceeding a defined threshold; enforce per-request CPU time limits and execution timeouts on all Markdown parsing; disable unused formatting plugins; implement rate limiting on parsing endpoints; add CPU and memory monitoring with alerting on parsing service anomalies.

Threat Intelligence Overview

EPSS Score
0.3%
Top 73% exploitable
Prevalence
Medium
popular Python Markdown library, but impact gated on optional plugins
Threat Intel
1
1 sources
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA MSRC Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Mistune

View all
CVE-2026-49851 HIGH POC
8.7 Jun 24

Uncontrolled CPU consumption in Mistune, a Python Markdown parser, allows remote unauthenticated attackers to cause deni
CVE-2017-15612 MEDIUM POC
6.1 Oct 19

mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address,

CVE-2026-115347 HIGH
8.7 Oct 22

Quadratic denial of service in Mistune's Markdown parser (parse_link_text) affects versions 3.2.0, 3.2.1 and main prior

CVE-2026-59928 HIGH POC
7.5 Jul 08

Denial of service in Mistune (the lepture Python Markdown parser) before 3.3.0 lets remote unauthenticated attackers exh
CVE-2026-59925 HIGH POC
7.5 Jul 08

Denial of service in Mistune, a widely used pure-Python Markdown parser, affects all versions prior to 3.3.0 where the d
CVE-2022-34749 HIGH
7.5 Jul 25

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high a
CVE-2017-16876 MEDIUM
6.1 Dec 29

Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote att
CVE-2026-59923 MEDIUM POC
6.1 Jul 08

Cross-site scripting in Mistune Python Markdown parser (all versions before 3.3.0) allows attacker-controlled Markdown c
CVE-2026-59929 MEDIUM POC
6.1 Jul 08

Cross-site scripting in Mistune prior to 3.3.0 stems from an incomplete URI scheme blocklist in the `safe_url` filter, p
CVE-2026-59924 MEDIUM POC
5.9 Jul 08

Path traversal in Mistune's Include plugin allows reading arbitrary files from the server filesystem when processing att
CVE-2026-59926 MEDIUM
5.3 Jul 08

Cross-site scripting in Mistune (Python Markdown parser) prior to version 3.2.1 allows injection of arbitrary HTML attri
CVE-2026-59927 MEDIUM POC
5.3 Jul 08

Unbounded recursion in Mistune's Include directive (all versions prior to 3.3.0) can be triggered by a pair of mutually-

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all
CVE-2026-90776 HIGH POC
8.7
CVE-2026-59094 HIGH POC
8.7
CVE-2026-54284 HIGH POC
8.7
CVE-2022-45061 HIGH POC
7.5
CVE-2026-71321 HIGH POC
7.5
CVE-2026-59887 HIGH POC
7.5
CVE-2026-73643 HIGH POC
7.5
CVE-2026-59870 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2210.yaml ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-59922 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22655/ REF https://github.com/lepture/mistune/commit/96d0f57f8fe9eeb06bb4cff521962a27d7c402e7 REF https://github.com/lepture/mistune/releases/tag/v3.3.0 REF https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy