VulnerabilityAnalyzed

CVE-2026-59925

Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential…

HIGH 7.5EPSS 0.64%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.64%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.64% probability · 49th percentile
CISA KEV: Not listed
Weakness: CWE-407, CWE-1333
Affected: mistune project/mistune
Source: security-advisories@github.com

References

https://github.com/lepture/mistune/commit/5de41fb8e527004dbc363e047a3c380c9288c74fPatch
https://github.com/lepture/mistune/releases/tag/v3.3.0Release Notes
https://github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.