CVE-2026-59922 | Mistune is a Python Markdown parser with renderers and plugi… | CVSS 7.5 HIGH

Description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

Metadata

CVE ID: CVE-2026-59922
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-07-07 18:20 UTC
Published: 2026-07-08 16:12 UTC
Last updated: 2026-07-08 16:12 UTC
Primary CWE: CWE-407
CWE-407: Inefficient Algorithmic Complexity
Vendor / Product: lepture / mistune
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products (1)

Vendor	Product	Platform	Versions
lepture	mistune	—	< 3.3.0

Weakness (CWE)

CWE	Source	Description
CWE-1333	cna	CWE-1333: Inefficient Regular Expression Complexity
CWE-407	cna	CWE-407: Inefficient Algorithmic Complexity

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (3)

https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq
https://github.com/lepture/mistune/commit/96d0f57f8fe9eeb06bb4cff521962a27d7c402e7 https://github.com/lepture/mistune/commit/96d0f57f8fe9eeb06bb4cff521962a27d7c402e7
https://github.com/lepture/mistune/releases/tag/v3.3.0 https://github.com/lepture/mistune/releases/tag/v3.3.0