Patched code sample

import re

# This regex simulates the pattern matching for a reference-style link definition
# e.g., [key]: /url "title"
REF_LINK_PATTERN = re.compile(
    r'^ {0,3}\[([^\]]+)\]:'  # [key]:
    r'[ \t]*'               # optional whitespace
    r'<?([^\s>]+)>?'        # <url> or url
    r'(?:[ \t]+'            # optional title
    r'(?:"([^"]+)"|\'([^\']+)\'|\(([^\)]+)\)))?'
    r'[ \t]*$'
)

def parse_reference_definitions_fixed(text: str, state: dict):
    """
    Efficiently parse a block of text for reference-link definitions.

    This function represents the logic of the patched Mistune version. The
    vulnerability (CVE-2026-59928) was caused by quadratic complexity when
    handling a large number of link definitions.

    The fix is to process each line only once and use efficient dictionary
    operations (which are O(1) on average) to store the results. By checking
    `if key not in ref_links` before adding, we ensure that only the first
    definition for a given key is used, and we avoid any repeated, expensive
    work that would lead to a Denial of Service.
    """
    ref_links = state.setdefault("ref_links", {})
    lines = text.split('\n')
    for line in lines:
        match = REF_LINK_PATTERN.match(line)
        if match:
            key = match.group(1).lower().strip()
            # The efficient fix: only add the key if it's not already defined.
            # Dictionary lookups (`in`) and assignments are O(1) on average,
            # making the overall algorithm O(N) for N lines.
            if key not in ref_links:
                url = match.group(2)
                # Use the first non-None title group
                title = match.group(3) or match.group(4) or match.group(5)
                ref_links[key] = (url, title)
    return state