High severity7.5OSV Advisory· Published Jul 8, 2026· Updated Jul 9, 2026
CVE-2026-59928
CVE-2026-59928
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mistunePyPI | < 3.3.0 | 3.3.0 |
Affected products
4cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*range: <3.3.0
- (no CPE)range: <3.3.0
Patches
Vulnerability mechanics
References
6- github.com/lepture/mistune/commit/2b04d7ba341c16ac78fe82d3076bdd5c3de87c69nvdPatchWEB
- github.com/lepture/mistune/security/advisories/GHSA-ffq3-xpv3-j92qnvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-ffq3-xpv3-j92qghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-59928ghsaADVISORY
- github.com/lepture/mistune/releases/tag/v3.3.0nvdRelease NotesWEB
- github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2216.yamlghsaWEB
News mentions
2- Mistune Project: Nine Vulnerabilities Including DoS and XSS Disclosed TogetherVypr Intelligence · Jul 9, 2026
- Authlib Mistune: Nine Vulnerabilities Including DoS and XSS Disclosed TogetherVypr Intelligence · Jul 9, 2026