Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*

3 briefs RSS
low advisory

Mistune Quadratic-Time Parsing Vulnerability in Formatting Plugins

The mistune Python library, when used with the 'strikethrough', 'mark', or 'insert' plugins enabled, is vulnerable to an algorithmic-complexity denial-of-service (DoS) attack where an attacker can send specially crafted markdown input causing quadratic parsing time, leading to high CPU utilization and potential service outages.

mistune denial-of-service re-dos python library-vulnerability
1t 1c
medium advisory

CVE-2026-59928 Mistune block_parser: Quadratic-Time Parsing Leading to Denial of Service

CVE-2026-59928 identifies a vulnerability in the Mistune block_parser component where quadratic-time parsing of long lists of repeated reference-link definitions can be exploited by an attacker to cause a denial-of-service condition due to excessive resource consumption.

Mistune block_parser denial-of-service vulnerability markdown-parser
1c
medium advisory

Mistune Markdown Parser Vulnerability CVE-2026-59930 Allows HTML ID Collision

A vulnerability, CVE-2026-59930, in the Mistune markdown parser's TableOfContents directive creates predictable HTML heading IDs, enabling an attacker to inject content with colliding IDs for client-side content manipulation.

Mistune vulnerability markdown client-side cve
1c