CVE-2026-121437
Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "*a_b" to trigger an O(n²) index-fixup loop, stalling workers for seconds.
| CWE | CWE-407 |
| Vendor | lepture |
| Product | mistune |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for lepture mistune
Be the first to know when new high vulnerabilities affecting lepture mistune are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
lepture / mistune
3.3.0 < 3.3.4
References
github.com: https://github.com/lepture/mistune/security/advisories/GHSA-qp42-r9j6-83g9 github.com: https://github.com/lepture/mistune/commit/b4dd3284e52ec741ed9a227db29ade9017828e90 vulncheck.com: https://www.vulncheck.com/advisories/mistune-3.3.0-before-3.3.4-quadratic-time-dos-via-process-emphasis-delimiters
Credits
🔍 manus-use