Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.
Published: 2026-07-08
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Mistune is a Python Markdown parser that suffered from a quadratic-time parsing bug caused by src/mistune/block_parser.py. The bug leads to CPU exhaustion, which can be exploited to cause a denial of service. The weakness is related to inefficient handling of reference‑link definitions (CWE-1333, CWE-407).

Affected Systems

Applications using lepture:mistune are affected, including any projects releases. The fix is available in Mistune 3.3.0 and later releases.

Risk and Exploitability

Based on the description, it is inferred that the likely attack vector is the submission of a specially crafted Markdown document, for example, via a web application. The CVSS score indicates high severity, but the EPSS score is < 1%, reflecting a very low exploitation probability. The vulnerability is not listed in KEV. An attacker could supply such a document, causing the parser to consume excess CPU resources and lead to denial of service, degrading service availability to the point of denial.

Generated by OpenCVE AI on July 29, 2026 at 13:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mistune to version 3.3.0 or later to remove the quadratic parsing flaw.
  • When an upgrade is not immediately possible, limit the size and complexity of user-supplied Markdown input to mitigate unlimited CPU consumption.
  • Configure system resource limits or use a dedicated parsing worker with CPU quotas to isolate the impact of the bug.

Generated by OpenCVE AI on July 29, 2026 at 13:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-ffq3-xpv3-j92q Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
History

Fri, 10 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-606
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 08 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Lepture
Lepture mistune
Vendors & Products Lepture
Lepture mistune

Wed, 08 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Description Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.
Title Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
Weaknesses CWE-1333
CWE-407
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Lepture Mistune
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-08T19:40:43.968Z

Reserved: 2026-07-07T18:20:06.126Z

Link: CVE-2026-59928

cve-icon Vulnrichment

Updated: 2026-07-08T17:45:57.618Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-08T16:23:21Z

Links: CVE-2026-59928 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T14:00:03Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity

  • CWE-407

    Inefficient Algorithmic Complexity

  • CWE-606

    Unchecked Input for Loop Condition