UBUNTU-CVE-2026-121437: High severity ubuntu/mistune vulnerability

Published Nov 3, 2026

Updated

Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "ab" to trigger an O(n²) index-fixup loop, stalling workers for seconds.

Affected Software

7 affected components

ubuntu/mistune*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Mistune to a version that resolves this vulnerability.
Fixed in 3.3.4

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Systems using Mistune versions 3.3.0 through before 3.3.4 are affected when remote users can submit Markdown that the application parses. The attack is network-reachable and requires no authentication or user interaction.

What input is needed to trigger the issue?

An attacker can submit a small Markdown document containing repeated emphasis-delimiter patterns, such as "*a_b". These patterns trigger quadratic-time delimiter index fixup processing and can stall workers for seconds.

What is the immediate mitigation if upgrading is not possible?

The provided information identifies attacker-controlled Markdown parsing as the exposure point. Restrict or disable untrusted Markdown submission where feasible to prevent remote attackers from supplying the triggering input.

UBUNTU-CVE-2026-121437: High severity ubuntu/mistune vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What input is needed to trigger the issue?

What is the immediate mitigation if upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What input is needed to trigger the issue?

What is the immediate mitigation if upgrading is not possible?