{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/re-dos/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-59922"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mistune (\u003c 3.3.0)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","re-dos","python","library-vulnerability"],"_cs_type":"advisory","_cs_vendors":["mistune"],"content_html":"\u003cp\u003eThe mistune Python markdown parser library is susceptible to an algorithmic-complexity denial-of-service (DoS) vulnerability, tracked as CVE-2026-59922, when specific formatting plugins are enabled. This vulnerability impacts versions of mistune prior to 3.3.0. Attackers can exploit this by submitting specially crafted markdown input containing long, repeated sequences of \u003ccode\u003e~~x~~\u003c/code\u003e, \u003ccode\u003e==x==\u003c/code\u003e, or \u003ccode\u003e^^x^^\u003c/code\u003e markers, which are used for strikethrough, mark, and insert formatting respectively. The parsing process for these inputs exhibits quadratic time complexity (O(N²)), meaning the CPU time required quadruples when the input size doubles. This can cause applications using mistune to parse user-supplied markdown to experience severe CPU exhaustion, leading to significant performance degradation or complete service outages. While the affected plugins are not enabled by default, they are commonly activated in applications requiring GitHub-flavored Markdown or similar extensions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies an application using the \u003ccode\u003emistune\u003c/code\u003e library to render user-supplied markdown content.\u003c/li\u003e\n\u003cli\u003eThe application has one or more of the \u003ccode\u003estrikethrough\u003c/code\u003e, \u003ccode\u003emark\u003c/code\u003e, or \u003ccode\u003einsert\u003c/code\u003e plugins enabled (e.g., \u003ccode\u003eplugins=['strikethrough']\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a markdown payload, such as \u003ccode\u003e~~x~~\u003c/code\u003e repeated 8000 times (approximately 8 KB in size). Analogous payloads use \u003ccode\u003e==x==\u003c/code\u003e or \u003ccode\u003e^^x^^\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker submits this specially crafted markdown payload to the vulnerable application.\u003c/li\u003e\n\u003cli\u003eThe application invokes \u003ccode\u003emistune.create_markdown(...)(payload)\u003c/code\u003e to process the input.\u003c/li\u003e\n\u003cli\u003eDue to the quadratic-time parsing logic for these specific markers, the application's CPU becomes heavily utilized; an 8 KB payload can peg the CPU for approximately 4 seconds, while a 16 KB payload extends this to about 17 seconds.\u003c/li\u003e\n\u003cli\u003eRepeated requests with such payloads can exhaust the application's worker pool, leading to a denial of service for legitimate users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-59922 results in a denial-of-service condition for applications relying on the mistune library with affected plugins. The primary impact is severe CPU exhaustion on the server, which can lead to application unresponsiveness, slow processing of legitimate requests, or complete service outages. An 8 KB malicious input can consume a single CPU core for roughly 4 seconds, while a 16 KB input extends this to 17 seconds, and 32 KB to 70 seconds. This predictable quadratic scaling means that even small, unauthenticated requests can significantly degrade or halt service, particularly in single-threaded environments or when attacker requests overwhelm thread pools. There is no significant memory growth observed, but the pure CPU cost can effectively render the application unusable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003emistune\u003c/code\u003e Python package to version 3.3.0 or later to patch CVE-2026-59922, as described in the affected_products section.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, review application configurations to determine if the \u003ccode\u003estrikethrough\u003c/code\u003e, \u003ccode\u003emark\u003c/code\u003e, or \u003ccode\u003einsert\u003c/code\u003e plugins are enabled. Consider disabling these plugins if they are not critical for your application's functionality.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T21:35:48Z","date_published":"2026-07-20T21:35:48Z","id":"https://feed.craftedsignal.io/briefs/2026-07-mistune-quadratic-redos/","summary":"The mistune Python library, when used with the 'strikethrough', 'mark', or 'insert' plugins enabled, is vulnerable to an algorithmic-complexity denial-of-service (DoS) attack where an attacker can send specially crafted markdown input causing quadratic parsing time, leading to high CPU utilization and potential service outages.","title":"Mistune Quadratic-Time Parsing Vulnerability in Formatting Plugins","url":"https://feed.craftedsignal.io/briefs/2026-07-mistune-quadratic-redos/"}],"language":"en","title":"CraftedSignal Threat Feed - Re-Dos","version":"https://jsonfeed.org/version/1.1"}