Skip to content
Threat Feed
Subscribe

Vendor

Mistune

3 briefs RSS
low advisory

Mistune Quadratic-Time Parsing Vulnerability in Formatting Plugins

The mistune Python library, when used with the 'strikethrough', 'mark', or 'insert' plugins enabled, is vulnerable to an algorithmic-complexity denial-of-service (DoS) attack where an attacker can send specially crafted markdown input causing quadratic parsing time, leading to high CPU utilization and potential service outages.

mistune denial-of-service re-dos python library-vulnerability
1t 1c
medium advisory

CVE-2026-59928 Mistune block_parser: Quadratic-Time Parsing Leading to Denial of Service

CVE-2026-59928 identifies a vulnerability in the Mistune block_parser component where quadratic-time parsing of long lists of repeated reference-link definitions can be exploited by an attacker to cause a denial-of-service condition due to excessive resource consumption.

Mistune block_parser denial-of-service vulnerability markdown-parser
1c
medium advisory

Mistune Markdown Parser Vulnerable to CPU Exhaustion DoS (CVE-2026-49851)

The Mistune Python Markdown parser is vulnerable to a CPU exhaustion Denial of Service (DoS) attack, identified as CVE-2026-49851, due to a superlinear (O(n²)) parsing behavior in the `parse_link_text` function when processing specially crafted input containing repeated square brackets, allowing an attacker to significantly degrade application performance with a small payload.

mistune denial-of-service python library vulnerability markdown
1t 1c