CVE-2026-59922CWE-1333CWE-407

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

High · published July 8, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00644 · 50.2th percentile
Weaknesses
CWE-1333 · Inefficient Regular Expression Complexity; CWE-407 · Inefficient Algorithmic Complexity
Published
2026-07-08T16:12Z
EPSS history
Timeline
  • 08 JUL 16:12Z
    Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
    cvelistv5