Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. mistune
  4. ›
  5. CVE-2026-59928

CVE-2026-59928: Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

July 20, 2026

Type: Algorithmic-complexity DoS in reference-link definition handling. A markdown document with N reference-link definitions of the same key (or many distinct keys) takes O(N²) parser time. 5000 repeated [a]: u\n definitions take ~1.1 second; 10000 → ~4.5 seconds. File: src/mistune/block_parser.py (reference-link def parsing) and the surrounding ref_links env-dictionary handling. Root cause: every reference definition is parsed by scanning forward from each candidate position. The unikey normalisation runs per-def, the dictionary insert is per-def, and the lookup-by-label-then-iterate-defs path is linear in the number of stored defs. For input with N defs, the total work is O(N²).

References

  • github.com/advisories/GHSA-ffq3-xpv3-j92q
  • github.com/lepture/mistune/commit/2b04d7ba341c16ac78fe82d3076bdd5c3de87c69
  • github.com/lepture/mistune/releases/tag/v3.3.0
  • github.com/lepture/mistune/security/advisories/GHSA-ffq3-xpv3-j92q
  • github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2216.yaml
  • nvd.nist.gov/vuln/detail/CVE-2026-59928

Code Behaviors & Features

Detect and mitigate CVE-2026-59928 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 3.3.0

Fixed versions

  • 3.3.0

Solution

Upgrade to version 3.3.0 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-1333: Inefficient Regular Expression Complexity
  • CWE-407: Inefficient Algorithmic Complexity

Source file

pypi/mistune/CVE-2026-59928.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 08 Aug 2026 00:17:32 +0000.