CVE-2026-59925: Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Type: Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed **x** (strong) or ***x*** (strong-emphasis combined) pairs causes O(N²) parser work. Distinct from the bracket-bomb DoS ([ repetition) and from the formatting-plugin DoS (~~/==/^^); this one fires on default-config mistune with no plugins required.
File: src/mistune/inline_parser.py lines 41-48 (the EMPHASIS_END_RE family) and the surrounding emphasis dispatch.
Root cause: for every opening run of *s the parser scans forward using one of EMPHASIS_END_RE['*'] / ['**'] / ['***'] to find the matching close. Each scan is bounded per call, but the parser invokes the scan from every potential start position. For input shaped **x** repeated N times, every ** is treated as a potential start, each scan can cover up to the end of input. Total work is O(N²). The triple-emphasis variant ***x*** is slightly worse due to the extra alternation between *, **, and *** close patterns. Reproducible against default mistune with no plugins.
References
- github.com/advisories/GHSA-4j32-57v6-6g45
- github.com/lepture/mistune/commit/5de41fb8e527004dbc363e047a3c380c9288c74f
- github.com/lepture/mistune/releases/tag/v3.3.0
- github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45
- github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2213.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-59925
Code Behaviors & Features
Detect and mitigate CVE-2026-59925 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →