CVE-2026-59928: Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
Type: Algorithmic-complexity DoS in reference-link definition handling. A markdown document with N reference-link definitions of the same key (or many distinct keys) takes O(N²) parser time. 5000 repeated [a]: u\n definitions take ~1.1 second; 10000 → ~4.5 seconds.
File: src/mistune/block_parser.py (reference-link def parsing) and the surrounding ref_links env-dictionary handling.
Root cause: every reference definition is parsed by scanning forward from each candidate position. The unikey normalisation runs per-def, the dictionary insert is per-def, and the lookup-by-label-then-iterate-defs path is linear in the number of stored defs. For input with N defs, the total work is O(N²).
References
- github.com/advisories/GHSA-ffq3-xpv3-j92q
- github.com/lepture/mistune/commit/2b04d7ba341c16ac78fe82d3076bdd5c3de87c69
- github.com/lepture/mistune/releases/tag/v3.3.0
- github.com/lepture/mistune/security/advisories/GHSA-ffq3-xpv3-j92q
- github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2216.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-59928
Code Behaviors & Features
Detect and mitigate CVE-2026-59928 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →