CVE-2026-59927: Mistune Circular Include Recursion DoS (CVSS 5.3)

Technical summary

CVE-2026-59927 is a recursion-handling vulnerability in Mistune's Include directive (mistune/directives/include.py). The flaw exists in the cycle-detection mechanism, which employs only shallow detection of direct self-includes. When File A includes File B and File B includes File A, or when longer chains form (A→B→C→A), the parser lacks the graph-traversal logic necessary to identify and halt processing. Each recursive call consumes stack space until Python's recursion limit is hit, triggering an unhandled RecursionError. The affected CWE classifications are CWE-674 (Uncontrolled Recursion) and CWE-755 (Improper Handling of Exceptional Conditions). Resolution requires implementing a visited-set or call-stack tracking mechanism to detect cycles before entering recursion.

Business impact

For applications that render user-supplied or untrusted Markdown content—such as documentation platforms, content management systems, or collaborative editing tools—this vulnerability creates a denial-of-service (DoS) vector. An attacker with the ability to upload or modify Markdown files could craft a pair of mutually inclusive files that crash the rendering service. Legitimate users would experience unavailability during the attack. The impact is limited to availability; no data confidentiality or integrity loss occurs. Organizations relying on Mistune in production rendering pipelines should prioritize patching to avoid service disruptions.

Affected systems

Mistune versions prior to 3.3.0 are affected. The vulnerability is present in the Include directive module and only manifests when the directive is actively used—if an application uses Mistune purely for basic Markdown parsing without the Include extension, the risk is lower. Any deployment parsing Markdown with include directives enabled is at risk. The CVSS vector indicates network-accessible attack surface (AV:N), no special privileges required (PR:N), and no user interaction needed (UI:N), meaning a remote attacker can exploit this without authentication.

Exploitability

Exploitability is straightforward. An attacker needs only the ability to control or create Markdown content that will be parsed by a vulnerable Mistune instance with the Include directive enabled. No complex prerequisites, tools, or timing conditions are required. Proof of concept would involve creating two simple .md files that reference each other and triggering rendering. The lack of a KEV (Known Exploited Vulnerabilities) designation suggests no widespread active exploitation has been documented, but the simplicity of triggering the issue means organizations should not rely on obscurity for protection.

Remediation

Upgrade Mistune to version 3.3.0 or later. The patch implements proper cycle detection in the Include directive to identify and reject indirect circular references before recursion begins. After upgrading, test rendering pipelines with a representative set of Markdown files, particularly those using include directives. If inline upgrades are not immediately possible, consider temporarily disabling the Include directive in production if it is not essential, or implementing external input validation to reject Markdown files with obvious circular include patterns.

Patch guidance

1. Review your current Mistune version using `pip list` or equivalent package manager commands. 2. Check release notes for Mistune 3.3.0 to confirm the fix aligns with your environment. 3. Test the patched version in a staging environment with existing Markdown workflows to ensure no regressions. 4. Upgrade via `pip install --upgrade mistune>=3.3.0`. 5. Verify the Include directive is functioning as expected post-upgrade. 6. Document the update in your change log and deployment records. For applications with complex Markdown pipeline dependencies, confirm compatibility with other packages that may depend on Mistune before deploying to production.

Detection guidance

Monitor application logs for RecursionError exceptions during Markdown rendering, particularly those originating from mistune/directives/include.py. Implement alerts on recursive exception patterns. If you maintain control over uploaded or submitted Markdown files, scan for include directives that reference other files and perform static analysis to identify potential cycles—for example, by parsing the directive syntax and building an include graph. Runtime detection is reactive; code review and pre-processing validation are more proactive. Consider adding request-level timeouts for Markdown rendering operations to catch runaway recursion before it fully exhausts stack.

Why prioritize this

Although the CVSS score of 5.3 is medium severity, the ease of exploitation and the broad applicability of Markdown rendering in modern web services justify proactive remediation. The attack requires no authentication or user interaction, making it a straightforward remote DoS threat. Organizations that expose Markdown rendering to untrusted input should prioritize this patch within a 30–60 day window. Lower priority for internal-only Markdown use or where include directives are not enabled.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a medium-severity denial-of-service vulnerability with network accessibility, no privilege requirements, and no user interaction. The attack vector is network (AV:N), complexity is low (AC:L), privileges are not required (PR:N), user interaction is not required (UI:N), scope is unchanged (S:U), and the impact is limited to availability (A:L, with no confidentiality or integrity impact). The score appropriately captures that the vulnerability cannot lead to data breach or system compromise, but does create a reliable DoS path for remote attackers.

Frequently asked questions