GHSA-qp42-r9j6-83g9: Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "ab" to trigger an O(n²) index-fixup loop, stalling workers for seconds.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mistuneto a version that resolves this vulnerability.Fixed in 3.3.4
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Mistune versions 3.3.0 through 3.3.3 are exposed if they process markdown supplied by remote or otherwise untrusted users. The vulnerable emphasis-delimiter handling can stall workers while parsing crafted input.
What does an attacker need to exploit it?
An attacker only needs to submit crafted markdown containing repeated emphasis delimiter patterns, such as "*a_b". No authentication or user interaction is required according to the supplied severity vector.
Is the impact limited to a specific application function?
The documented impact is CPU exhaustion caused by quadratic-time processing in _process_emphasis_delimiters. This can delay or stall workers that parse the malicious markdown.
Which versions should be remediated?
Mistune 3.3.0 through 3.3.3 are affected. Version 3.3.4 is outside the stated affected range.