{"id":"CVE-2026-59922","title":"Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)","published":"2026-07-08T17:17:27.770Z","updated":"2026-10-25T17:10:00.197Z","severity":"high","cvssScore":7.5,"epss":0.00644,"epssPct":0.51379,"kev":false,"maturity":"none","actionScore":30,"primaryVendor":"mistune project","primaryProduct":"mistune","cweId":"CWE-407","fixAvailable":true,"tags":["pre-auth","dos","remote","no-ui"],"epssDelta7":0.003,"summary":"Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssVersion":"3.1","cvssSource":"nvd-secondary","cweName":"Inefficient Algorithmic Complexity","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"GitHub_M","ssvc":{"exploitation":"poc","automatable":"yes","impact":"partial"},"sources":{"adp":"2026-07-09T14:40:22.315Z","cna":"2026-07-09T14:40:22.315Z","nvd":"2026-10-25T17:10:00Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T11:23:39.688Z"},"cvssCna":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"hasPatchRef":true,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"mistune project","product":"mistune","cpe":"cpe:2.3:a:mistune_project:mistune"}],"references":[{"url":"https://github.com/lepture/mistune/commit/96d0f57f8fe9eeb06bb4cff521962a27d7c402e7","tags":"Patch"},{"url":"https://github.com/lepture/mistune/releases/tag/v3.3.0","tags":"Release Notes"}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"mistune project","product":"mistune","version":"*","vsi":null,"vse":null,"vei":null,"vee":"3.3.0"}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}