CVE-2026-59927CWE-674CWE-755

Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Medium · published July 8, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00529 · 44.0th percentile
Weaknesses
CWE-674 · Uncontrolled Recursion; CWE-755 · Improper Handling of Exceptional Conditions
Published
2026-07-08T16:24Z
EPSS history
Timeline
  • 08 JUL 16:24Z
    Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
    cvelistv5