CVE-2026-59925CWE-1333CWE-407

inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

High · published July 8, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00644 · 50.2th percentile
Weaknesses
CWE-1333 · Inefficient Regular Expression Complexity; CWE-407 · Inefficient Algorithmic Complexity
Published
2026-07-08T16:18Z
EPSS history
Timeline
  • 08 JUL 16:18Z
    inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
    cvelistv5