DEBIAN-CVE-2026-121437: High severity debian/mistune vulnerability
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "ab" to trigger an O(n²) index-fixup loop, stalling workers for seconds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mistuneto a version that resolves this vulnerability.Fixed in 3.3.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Mistune versions 3.3.0 through before 3.3.4 are affected when remote users can submit Markdown that the application parses.
What does an attacker need to do to exploit it?
No authentication or user interaction is required according to the supplied severity vector. An attacker needs to submit a crafted Markdown document containing repeated emphasis-delimiter patterns such as "*a_b" to trigger quadratic-time processing.
What is the practical impact?
Crafted small Markdown inputs can exhaust CPU and stall workers for seconds, resulting in denial of service. The provided impact data indicates availability impact only, with no stated confidentiality or integrity impact.
What should be done if an immediate upgrade is not possible?
The provided data does not specify a workaround. Limit or avoid processing untrusted Markdown inputs until Mistune can be updated to version 3.3.4 or later.