CVE-2026-59925: Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Type: Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed **x** (strong) or ***x*** (strong-emphasis combined) pairs causes O(N²) parser work. Distinct from the bracket-bomb DoS ([ repetition) and from the formatting-plugin DoS (~~/==/^^); this one fires on default-config mistune with no plugins required.
File: src/mistune/inline_parser.py lines 41-48 (the EMPHASIS_END_RE family) and the surrounding emphasis dispatch.
Root cause: for every opening run of *s the parser scans forward using one of EMPHASIS_END_RE['*'] / ['**'] / ['***'] to find the matching close. Each scan is bounded per call, but the parser invokes the scan from every potential start position. For input shaped **x** repeated N times, every ** is treated as a potential start, each scan can cover up to the end of input. Total work is O(N²). The triple-emphasis variant ***x*** is slightly worse due to the extra alternation between *, **, and *** close patterns. Reproducible against default mistune with no plugins.
References
- github.com/advisories/GHSA-4j32-57v6-6g45
- github.com/lepture/mistune/commit/5de41fb8e527004dbc363e047a3c380c9288c74f
- github.com/lepture/mistune/releases/tag/v3.3.0
- github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45
- github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2213.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-59925
Code Behaviors & Features
Detect and mitigate CVE-2026-59925 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →