CVE-2026-121437: Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters

Published Nov 3, 2026

Updated

Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "ab" to trigger an O(n²) index-fixup loop, stalling workers for seconds.

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Applications that use affected Mistune versions to process attacker-supplied Markdown over the network are exposed to CPU exhaustion. The issue affects Mistune versions from 3.3.0 up to, but not including, 3.3.4.

What does an attacker need to exploit this issue?

An attacker can submit a crafted Markdown document containing repeated emphasis-delimiter patterns such as "*a_b". No privileges or user interaction are required.

How can I determine whether my application is affected?

Check the version of Mistune used by the application. Versions 3.3.0 through 3.3.3 are affected; version 3.3.4 is outside the stated affected range.

CVE-2026-121437: Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether my application is affected?