CVE-2026-59925

inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

State: Published
Severity: 7.5 High
Published: Jul 8, 2026
Updated: Jul 8, 2026
Reserved: Jul 7, 2026

Description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-407 Inefficient Algorithmic Complexity
CWE-1333 Inefficient Regular Expression Complexity

Affected Products

Product	Versions
mistunelepture	< 3.3.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.