Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. mistune
  4. ›
  5. CVE-2026-59925

CVE-2026-59925: Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

July 20, 2026

Type: Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed **x** (strong) or ***x*** (strong-emphasis combined) pairs causes O(N²) parser work. Distinct from the bracket-bomb DoS ([ repetition) and from the formatting-plugin DoS (~~/==/^^); this one fires on default-config mistune with no plugins required. File: src/mistune/inline_parser.py lines 41-48 (the EMPHASIS_END_RE family) and the surrounding emphasis dispatch. Root cause: for every opening run of *s the parser scans forward using one of EMPHASIS_END_RE['*'] / ['**'] / ['***'] to find the matching close. Each scan is bounded per call, but the parser invokes the scan from every potential start position. For input shaped **x** repeated N times, every ** is treated as a potential start, each scan can cover up to the end of input. Total work is O(N²). The triple-emphasis variant ***x*** is slightly worse due to the extra alternation between *, **, and *** close patterns. Reproducible against default mistune with no plugins.

References

  • github.com/advisories/GHSA-4j32-57v6-6g45
  • github.com/lepture/mistune/commit/5de41fb8e527004dbc363e047a3c380c9288c74f
  • github.com/lepture/mistune/releases/tag/v3.3.0
  • github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45
  • github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2213.yaml
  • nvd.nist.gov/vuln/detail/CVE-2026-59925

Code Behaviors & Features

Detect and mitigate CVE-2026-59925 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 3.3.0

Fixed versions

  • 3.3.0

Solution

Upgrade to version 3.3.0 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-1333: Inefficient Regular Expression Complexity
  • CWE-407: Inefficient Algorithmic Complexity

Source file

pypi/mistune/CVE-2026-59925.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 08 Aug 2026 00:17:14 +0000.