Mistune, the Python Markdown parser, has a quadratic‑time parsing flaw when long sequences of closed tilde, equals, or caret markers—such as `~~x~~`, `==x==`, or `^^x^^`—are processed. The strikethrough, mark, or insert plugins scan from every possible start position for matching markers, causing CPU usage to grow quadratically with the length of the run. This excessive resource consumption can freeze or degrade the application and the underlying system. The weakness is characterized as CWE‑1333 (Time or Resource Manipulation) and CWE‑407 (Uncontrolled Resource Consumption).

All versions of the lepture:mistune package prior to 3.3.0 are affected. Applications that enable the strikethrough, mark, or insert plugins and parse user‑supplied Markdown are at risk.

Based on the description, it is inferred that the attacker can trigger the issue by sending crafted Markdown containing very long sequences of the vulnerable markers to an application that passes the content through Mistune. The CVSS score of 7.5 indicates high severity. The EPSS score of < 1% shows a very low but non‑zero likelihood that the vulnerability will be exploited. The issue is not listed in the CISA KEV catalog. Exploitation leads to CPU exhaustion and a denial‑of‑service condition.