CVE-2026-76098: Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

September 2, 2026

Mistune v3.3.2 is vulnerable to a Denial of Service (DoS) attack via uncontrolled recursion in the HTML rendering of deeply-nested emphasis tokens. By submitting Markdown containing approximately 1,000 consecutive asterisk characters, an attacker causes the Python process to crash with RecursionError.

References

github.com/advisories/GHSA-6m44-fpc8-c3rq
github.com/lepture/mistune/commit/0938fb781d0aded99de801b340ec1f8debeae5b2
github.com/lepture/mistune/releases/tag/v3.3.3
github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq
nvd.nist.gov/vuln/detail/CVE-2026-76098

Code Behaviors & Features

Detect and mitigate CVE-2026-76098 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →