Log in Start free

Vulnerability · Published Aug 24, 2026 · Assigned by GitHub_M

CVE-2026-76098Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

High 7.5

In plain English

A high-severity security flaw in mistune from lepture. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 57.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mistuneno fix listedDEBIAN-CVE-2026-76098
Debian:13mistuneno fix listedDEBIAN-CVE-2026-76098
Debian:14mistuneno fix listedDEBIAN-CVE-2026-76098
PyPImistune3.3.3GHSA-6m44-fpc8-c3rq
PyPImistune3.3.3PYSEC-2026-3863
Ubuntu:22.04:LTSmistuneno fix listedUBUNTU-CVE-2026-76098
Ubuntu:24.04:LTSmistuneno fix listedUBUNTU-CVE-2026-76098
Ubuntu:26.04:LTSmistuneno fix listedUBUNTU-CVE-2026-76098
Ubuntu:26.10mistuneno fix listedUBUNTU-CVE-2026-76098

Affected products (as reported)

VendorProductVersions
lepture mistune >= 3.3.0, < 3.3.3

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References