{"id":"CVE-2026-59928","title":"Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions","published":"2026-07-08T17:17:28.600Z","updated":"2026-10-25T17:10:00.197Z","severity":"high","cvssScore":7.5,"epss":0.00651,"epssPct":0.51706,"kev":false,"maturity":"none","actionScore":30,"primaryVendor":"mistune project","primaryProduct":"mistune","cweId":"CWE-407","fixAvailable":true,"tags":["pre-auth","dos","remote","no-ui"],"epssDelta7":0.0031,"summary":"Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssVersion":"3.1","cvssSource":"nvd-secondary","cweName":"Inefficient Algorithmic Complexity","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"GitHub_M","ssvc":{"exploitation":"poc","automatable":"yes","impact":"partial"},"sources":{"adp":"2026-07-08T19:40:43.968Z","cna":"2026-07-08T19:40:43.968Z","nvd":"2026-10-25T17:10:00Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T11:23:39.689Z"},"cvssCna":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"hasPatchRef":true,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"mistune project","product":"mistune","cpe":"cpe:2.3:a:mistune_project:mistune"}],"references":[{"url":"https://github.com/lepture/mistune/commit/2b04d7ba341c16ac78fe82d3076bdd5c3de87c69","tags":"Patch"},{"url":"https://github.com/lepture/mistune/releases/tag/v3.3.0","tags":"Release Notes"}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"mistune project","product":"mistune","version":"*","vsi":null,"vse":null,"vei":null,"vee":"3.3.0"}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}