CVE-2026-59928 Details
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.
A denial-of-service vulnerability has been identified in the Mistune Markdown parser, prior to version 3.3.0. The issue arises in the block parser's reference-link definition handling, where a document with numerous repeated or distinct reference-link definitions can cause quadratic processing time. This leads to CPU exhaustion, as the parser's time complexity increases with the square of the number of reference definitions. The vulnerability is present in versions through 3.2.1.
Users can upgrade to Mistune version 3.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lepture/mistune/security/advisories/GHSA-ffq3-xpv3-j92q | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/lepture/mistune/commit/2b04d7ba341c16ac78fe82d3076bdd5c3de87c69 | [email protected] | Patch |
| https://github.com/lepture/mistune/releases/tag/v3.3.0 | [email protected] | Release Notes |
| https://github.com/lepture/mistune/security/advisories/GHSA-ffq3-xpv3-j92q | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mistune project mistune | < 3.3.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |