CVE-2026-76098: Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

September 2, 2026

Mistune v3.3.2 is vulnerable to a Denial of Service (DoS) attack via uncontrolled recursion in the HTML rendering of deeply-nested emphasis tokens. By submitting Markdown containing approximately 1,000 consecutive asterisk characters, an attacker causes the Python process to crash with RecursionError.

References

github.com/advisories/GHSA-6m44-fpc8-c3rq
github.com/lepture/mistune/commit/0938fb781d0aded99de801b340ec1f8debeae5b2
github.com/lepture/mistune/releases/tag/v3.3.3
github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq
nvd.nist.gov/vuln/detail/CVE-2026-76098

Code Behaviors & Features

Detect and mitigate CVE-2026-76098 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →