CVE-2026-59922: Mistune Markdown Parser DoS Vulnerability

Technical summary

The vulnerability exists in src/mistune/plugins/formatting.py, where the strikethrough, mark, and insert plugins employ a flawed algorithm for scanning and matching formatting marker pairs. When processing input like ~~~~x~~~~ or ====x====, the parser iterates from every possible start position to find matching closing markers, resulting in quadratic O(n²) time complexity relative to the run length. An attacker can craft Markdown documents with long sequences of these markers, forcing the parser to perform millions of unnecessary comparisons. This is classified as a regular expression denial of service (ReDoS) variant affecting character-by-character scanning logic rather than regex engines, but with identical impact: computational exhaustion on untrusted input.

Business impact

Applications and services that parse user-submitted or untrusted Markdown content face immediate availability risk. This includes documentation systems, content management platforms, wiki engines, issue trackers, and any web service accepting Markdown input from users. An unauthenticated attacker requires only network access to trigger the vulnerability—no authentication, no complex exploitation steps. A single malicious document can consume CPU on an affected server long enough to degrade or crash service availability. Organizations running Mistune prior to 3.3.0 should treat this as a high-priority remediation to protect service uptime.

Affected systems

Any application using the Mistune Python library versions prior to 3.3.0 is vulnerable. This includes direct use of Mistune in Python applications, as well as any downstream projects or frameworks that bundle or depend on vulnerable Mistune versions. Systems accepting Markdown input from untrusted sources (public users, external submissions, API endpoints) face the highest risk. The vulnerability is present in all three affected plugins: strikethrough, mark, and insert. Systems running Mistune 3.3.0 or later are not affected.

Exploitability

Exploitability is very high. The vulnerability requires only network access and no authentication; an attacker can trigger it by submitting a single HTTP request containing a malicious Markdown document. The attack is trivial to execute—no special tools, no zero-day exploit code, and no user interaction required. Any application parsing untrusted Markdown is immediately exploitable if running a vulnerable version. The barrier to weaponization is minimal, making this vulnerability practically certain to be exploited in the wild against exposed services. No valid use case exists for the input patterns that trigger the vulnerability, so blocking or rate-limiting such input is a viable short-term mitigation.

Remediation

The authoritative fix is to upgrade Mistune to version 3.3.0 or later. This resolves the algorithmic flaw in the formatting plugin scanners. If immediate patching is not feasible, temporary mitigations include: (1) disable the strikethrough, mark, and insert plugins if not required; (2) implement input validation to reject Markdown containing runs of more than a threshold number of consecutive ~, =, or ^ characters; (3) enforce strict CPU timeouts on Markdown parsing operations; (4) rate-limit or require authentication for Markdown submission endpoints. These mitigations reduce attack surface but do not eliminate the underlying flaw. Prioritize upgrading to 3.3.0.

Patch guidance

Verify your Mistune version using `pip show mistune` or checking your requirements.txt or lock file. Upgrade to version 3.3.0 or later using `pip install --upgrade mistune>=3.3.0`. If Mistune is a transitive dependency (pulled in by another package), check that package's documentation for a release that pins Mistune 3.3.0 or later. Test the upgraded library against your Markdown parsing workflows to ensure no plugin behavior changes. Applications should be restarted after the upgrade to load the patched code. Verify the upgrade with `pip show mistune` again to confirm version 3.3.0 or higher is installed.

Detection guidance

Monitor application logs for Markdown parsing operations that consume unusual CPU time or trigger timeouts. Look for patterns in submitted Markdown that contain long runs of consecutive ~, =, or ^ characters—these are strong indicators of exploitation attempts. Network intrusion detection systems can be configured to flag HTTP requests containing payloads with repeated sequences of these characters, particularly in expected Markdown input fields. Application performance monitoring (APM) tools should alert on CPU spikes or parsing latency during Markdown operations. If available, enable debug logging in Mistune to observe which input triggers heavy processing. Forensic analysis of successful attacks should focus on identifying which service endpoints accept Markdown and whether input filtering was bypassed.

Why prioritize this

This vulnerability scores 7.5 (HIGH) with perfect exploitability: unauthenticated, no user interaction, no complexity. While impact is confined to availability (not confidentiality or integrity), DoS vulnerabilities can be as business-critical as data breaches if they affect customer-facing systems. The attack is trivial to execute at scale—attackers can target many services simultaneously with minimal effort. There is no compensating control short of patching or input filtering. Any organization exposing Markdown parsing to untrusted sources should treat this as a critical availability risk and prioritize patching within days, not weeks.

Risk score, explained

CVSS 7.5 reflects the intersection of maximum attack vector (network, unauthenticated, no user interaction) with high availability impact and no confidentiality or integrity loss. The score accurately captures that this is a practical, immediate threat to service uptime but does not exfiltrate data or compromise system integrity. In environments where Markdown parsing is internal-only or restricted to authenticated users, the effective risk is lower; in public-facing services, the risk approaches critical. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is appropriate and reflects real-world exploitability without overstating impact scope.

Frequently asked questions