CVE-2026-59925 | Mistune is a Python Markdown parser with renderers and plugi… | CVSS 7.5 HIGH

Description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

Metadata

CVE ID: CVE-2026-59925
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-07-07 18:20 UTC
Published: 2026-07-08 16:18 UTC
Last updated: 2026-07-08 19:44 UTC
Primary CWE: CWE-407
CWE-407: Inefficient Algorithmic Complexity
Vendor / Product: lepture / mistune
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
lepture	mistune	—	< 3.3.0

Weakness (CWE)

CWE	Source	Description
CWE-1333	cna	CWE-1333: Inefficient Regular Expression Complexity
CWE-407	cna	CWE-407: Inefficient Algorithmic Complexity

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (3)

https://github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45 https://github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45
https://github.com/lepture/mistune/commit/5de41fb8e527004dbc363e047a3c380c9288c74f https://github.com/lepture/mistune/commit/5de41fb8e527004dbc363e047a3c380c9288c74f
https://github.com/lepture/mistune/releases/tag/v3.3.0 https://github.com/lepture/mistune/releases/tag/v3.3.0