Log in Start free

Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-59922Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

High 7.5

In plain English

A high-severity regular-expression denial of service in mistune from lepture. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 48.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13mistuneno fix listedDEBIAN-CVE-2026-59922
Debian:14mistuneno fix listedDEBIAN-CVE-2026-59922
PyPImistune3.3.0GHSA-c8j7-8cv4-2xmq
PyPImistune3.3.0PYSEC-2026-2210
Ubuntu:22.04:LTSmistuneno fix listedUBUNTU-CVE-2026-59922
Ubuntu:24.04:LTSmistuneno fix listedUBUNTU-CVE-2026-59922
Ubuntu:25.10mistuneno fix listedUBUNTU-CVE-2026-59922
Ubuntu:26.04:LTSmistuneno fix listedUBUNTU-CVE-2026-59922
Ubuntu:26.10mistuneno fix listedUBUNTU-CVE-2026-59922

Affected products (as reported)

VendorProductVersions
lepture mistune < 3.3.0

Weakness: CWE-407, CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References