cbcvebase.
CVE-2026-59928
published 2026-07-08

CVE-2026-59928: Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link…

PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.37%
28.8th percentile
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
lepturemistune< 3.3.03.3.0
mistune_projectmistune< 3.3.03.3.0
mtamta-solution-server-rhel9——
rhoaiodh-pipeline-runtime-datascience-cpu-py312-rhel9——
rhoaiodh-pipeline-runtime-minimal-cpu-py312-rhel9——
rhoaiodh-pipeline-runtime-pytorch-cuda-py312-rhel9——
rhoaiodh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9——
rhoaiodh-pipeline-runtime-pytorch-rocm-py312-rhel9——
rhoaiodh-pipeline-runtime-tensorflow-cuda-py312-rhel9——
rhoaiodh-pipeline-runtime-tensorflow-rocm-py312-rhel9——
rhoaiodh-th06-cpu-torch210-py312-rhel9——
rhoaiodh-th06-cpu-torch291-py312-rhel9——
rhoaiodh-th06-cuda130-torch210-py312-rhel9——
rhoaiodh-th06-cuda130-torch291-py312-rhel9——
rhoaiodh-th06-rocm64-torch291-py312-rhel9——
rhoaiodh-workbench-jupyter-datascience-cpu-py312-rhel9——
rhoaiodh-workbench-jupyter-minimal-cpu-py312-rhel9——
rhoaiodh-workbench-jupyter-minimal-cuda-py312-rhel9——
rhoaiodh-workbench-jupyter-minimal-rocm-py312-rhel9——
rhoaiodh-workbench-jupyter-pytorch-cuda-py312-rhel9——
rhoaiodh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9——
rhoaiodh-workbench-jupyter-pytorch-rocm-py312-rhel9——
rhoaiodh-workbench-jupyter-tensorflow-cuda-py312-rhel9——
rhoaiodh-workbench-jupyter-tensorflow-rocm-py312-rhel9——
rhoaiodh-workbench-jupyter-trustyai-cpu-py312-rhel9——

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.