Mistune, a pure‑Python Markdown parser, contains a flaw in its inline_parser that triggers a quadratic‑time scan when processing text with long sequences of correctly matched double or triple asterisk emphasis markers around a single character. Each potential opening marker leads the parser to scan forward for a closing marker, causing CPU usage to grow roughly with the square of the input size. An attacker can supply a small Markdown string that follows this pattern, forcing the rendering process to consume excessive computational resources and leading to a denial‑of‑service condition.

All releases of Lepture Mistune before version 3.3.0 are affected. Any application importing or utilizing Mistune to render user‑supplied Markdown – such as web frameworks, static site generators, CMS plugins, or APIs – may expose the vulnerability when the inline_parser is invoked during rendering. The vulnerability resides in the inline_parser module, so any component that triggers that code could be exploited. (These use cases are inferred from common use patterns of Mistune.)

The CVSS score of 7.5 denotes a high severity vulnerability, while the EPSS score of less than 1% indicates it is rarely exploited. The flaw is not listed in CISA’s KEV catalog. An attacker does not need privileged access; sending a malicious Markdown payload to any endpoint that forwards text to Mistune is sufficient. Based on the description, the likely attack vector is a crafted Markdown document sent to a public or authenticated endpoint that performs server‑side rendering, which will cause the parsing engine to consume excessive CPU resources.