CVE-2026-59928
published 2026-07-08CVE-2026-59928: Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.65%
51.1th percentile
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lepture | mistune | < 3.3.0 | 3.3.0 |
| mistune_project | mistune | < 3.3.0 | 3.3.0 |
| mistune_project | mistune | >= 0 < 3.3.0 | 3.3.0 |
| mta | mta-solution-server-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
ghsa·2026-07-20
CVE-2026-59928 [HIGH] CWE-1333 Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
## Summary
**Type:** Algorithmic-complexity DoS in reference-link definition handling. A markdown document with N reference-link definitions of the same key (or many distinct keys) takes O(N²) parser time. 5000 repeated `[a]: u\n` definitions take ~1.1 second; 10000 → ~4.5 seconds.
**File:** `src/mistune/block_parser.py` (reference-link def parsing) and the surrounding `ref_links` env-dictionary handling.
**Root cause:** every reference definition is parsed by scanning forward from each candidate position. The `unikey` normalisation runs per-def, the dictionary insert is per-def, and the lookup-by-label-then-iterate-defs path is linear in the number of stored defs. For input with N defs, the
Red Hat
mistune: Mistune: Denial of Service via crafted Markdown document with reference-link definitions
vendor_redhat·2026-07-08·CVSS 7.5
CVE-2026-59928 [HIGH] CWE-606 mistune: Mistune: Denial of Service via crafted Markdown document with reference-link definitions
mistune: Mistune: Denial of Service via crafted Markdown document with reference-link definitions
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.
A flaw was found in Mistune, a Python Markdown parser. A remote attacker could exploit this vulnerability by providing a specially crafted Markdown document containing numerous repeated or distinct reference-link definitions. This can lead to excessive processing, causing CPU exhaustion and a denial of service (DoS) for the affected system.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59928 python-mistune: Mistune: Denial of Service via crafted Markdown document with reference-link definitions [fedora-all]
bugzilla·2026-07-28·CVSS 7.5
CVE-2026-59928 [HIGH] CVE-2026-59928 python-mistune: Mistune: Denial of Service via crafted Markdown document with reference-link definitions [fedora-all]
CVE-2026-59928 python-mistune: Mistune: Denial of Service via crafted Markdown document with reference-link definitions [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.
Bugzilla
CVE-2026-59928 python-mistune08: Mistune: Denial of Service via crafted Markdown document with reference-link definitions [epel-all]
bugzilla·2026-07-28·CVSS 7.5
CVE-2026-59928 [HIGH] CVE-2026-59928 python-mistune08: Mistune: Denial of Service via crafted Markdown document with reference-link definitions [epel-all]
CVE-2026-59928 python-mistune08: Mistune: Denial of Service via crafted Markdown document with reference-link definitions [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.
Bugzilla
CVE-2026-59928 python-mistune: Mistune: Denial of Service via crafted Markdown document with reference-link definitions [epel-all]
bugzilla·2026-07-28·CVSS 7.5
CVE-2026-59928 [HIGH] CVE-2026-59928 python-mistune: Mistune: Denial of Service via crafted Markdown document with reference-link definitions [epel-all]
CVE-2026-59928 python-mistune: Mistune: Denial of Service via crafted Markdown document with reference-link definitions [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.
Bugzilla
CVE-2026-59928 mistune: Mistune: Denial of Service via crafted Markdown document with reference-link definitions
bugzilla·2026-07-08·CVSS 7.5
CVE-2026-59928 [HIGH] CVE-2026-59928 mistune: Mistune: Denial of Service via crafted Markdown document with reference-link definitions
CVE-2026-59928 mistune: Mistune: Denial of Service via crafted Markdown document with reference-link definitions
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.
2026-07-08
Published