Mistune CVE-2026-76098

The target application must accept user-supplied content and pass it to Mistune 3.3.0-3.3.2 for parsing and HTML rendering - this is the sole prerequisite. No authentication is required when the Markdown input endpoint is publicly accessible (CVSS PR:N confirmed). No non-default Mistune configuration or plugin is needed; the vulnerability is present in the default InlineParser with emphasis parsing enabled, which is the out-of-box state. The primary limiting factor is deployment pattern: applications that render Markdown only from trusted internal or author-controlled sources (static site generators, internal wikis with admin-only authorship) are not reachable by external attackers. Applications with public comment fields, issue trackers, API endpoints accepting Markdown bodies, or documentation platforms with user submissions are directly exploitable.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well-supported by the technical evidence: any network-reachable endpoint that pipes user input into Mistune 3.3.0-3.3.2 is exploitable with a single, trivially crafted HTTP request. Attack complexity is genuinely low - the fix commit's own test case is a 2001-character string, requiring no reverse engineering or environment-specific knowledge. Impact is bounded strictly to availability; there is no confidentiality or integrity exposure. No EPSS score is available in the provided intelligence, so exploitation probability cannot be quantified statistically; absence from CISA KEV indicates no confirmed active exploitation at time of analysis. Real-world priority should be calibrated by exposure surface: a public-facing comment system or documentation platform parsing untrusted Markdown is a reliable crash target, while an offline static site generator consuming author-controlled files carries negligible risk. The straightforward attack pattern and zero-prerequisite exploitation make this a meaningful operational risk for any service in the former category, despite the DoS-only impact ceiling.

An attacker submits a POST request to a web application's comment or document-rendering endpoint with a Markdown body consisting of 1000 asterisks, a single letter, and 1000 more asterisks. Mistune 3.3.x builds an unbounded nested emphasis token tree from this input, and the recursive HTMLRenderer.render_token() call exhausts Python's default recursion limit, raising RecursionError and crashing the worker process or thread. The attack is repeatable and requires only HTTP access to any endpoint that renders user-supplied Markdown.