CVE-2026-59922: Mistune Python Markdown DoS Vulnerability

CVE-2026-59922 Overview

CVE-2026-59922 is an algorithmic complexity vulnerability in Mistune, a Python Markdown parser with pluggable renderers. Versions prior to 3.3.0 perform quadratic work when the strikethrough, mark, or insert plugins scan for matching marker pairs. An attacker who submits crafted Markdown containing long runs of closed tilde (~~), equals-sign (==), or caret (^) marker pairs around a character forces the parser to consume CPU disproportionate to input size. The flaw resides in src/mistune/plugins/formatting.py and is categorized under [CWE-407] Inefficient Algorithmic Complexity. Version 3.3.0 corrects the marker scanning behavior.

Critical Impact
Remote unauthenticated attackers can trigger CPU exhaustion in any service that renders untrusted Markdown through Mistune's formatting plugins, leading to denial of service.

Affected Products

Mistune Python Markdown parser versions prior to 3.3.0
Applications using the strikethrough, mark, or insert formatting plugins
Web services and APIs that render user-supplied Markdown via Mistune

Discovery Timeline

2026-07-08 - CVE-2026-59922 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59922

Vulnerability Analysis

The vulnerability affects Mistune's inline formatting plugins that implement GitHub-flavored strikethrough, mark, and insert syntax. Each plugin scans forward from every possible start position to locate a matching closing marker pair. When the input contains many closed marker pairs surrounding characters, the scanner repeatedly reprocesses overlapping regions. The result is worst-case O(n²) execution time relative to input length. A small Markdown payload of a few kilobytes can therefore consume seconds to minutes of CPU on a single request.

Root Cause

The root cause is inefficient marker scanning logic in src/mistune/plugins/formatting.py. The original implementation did not memoize failed match attempts or bound the search window. Every candidate start position triggers a fresh forward scan through subsequent markers. Repeated patterns such as ~~a~~a~~a~~... therefore multiply the scanner's work quadratically.

Attack Vector

An unauthenticated remote attacker submits a Markdown document containing long sequences of paired ~~, ==, or ^ markers. Any endpoint that passes untrusted Markdown through Mistune with the vulnerable plugins enabled — comment systems, wikis, chat renderers, README previews, or documentation generators — will hang while parsing. Concurrent requests amplify the impact and can exhaust worker pools.

python

# Security patch in src/mistune/plugins/formatting.py
# Commit 96d0f57f8fe9eeb06bb4cff521962a27d7c402e7
-import re
-from typing import TYPE_CHECKING, Match, Optional, Pattern
+from typing import TYPE_CHECKING, Match, Optional
 
 from ..helpers import PREVENT_BACKSLASH

# Source: https://github.com/lepture/mistune/commit/96d0f57f8fe9eeb06bb4cff521962a27d7c402e7
# The fix rewrites the marker scanning to avoid re-scanning overlapping
# regions, removing the quadratic behavior in strikethrough, mark, and insert plugins.

Detection Methods for CVE-2026-59922

Indicators of Compromise

Sustained high CPU utilization in Python worker processes handling Markdown rendering requests
Request latency spikes or timeouts correlated with POST bodies containing repetitive ~~, ==, or ^ sequences
Web server worker pool saturation without proportional network or database load
Application logs showing Mistune parser calls exceeding normal execution time thresholds

Detection Strategies

Inspect inbound request bodies for Markdown payloads containing dense runs of paired tilde, equals, or caret markers
Instrument Mistune render calls with per-request timers and alert on outliers beyond a defined budget
Correlate application CPU spikes with request identifiers to isolate malicious payloads
Audit dependency manifests (requirements.txt, pyproject.toml, Pipfile.lock) for Mistune versions below 3.3.0

Monitoring Recommendations

Enable request-level CPU and wall-clock metrics on services that render user Markdown
Set alerting thresholds on p99 latency and worker CPU saturation for Markdown endpoints
Log the size and pattern density of Markdown inputs above configurable limits for post-incident review
Track dependency inventory changes to flag reintroduction of vulnerable Mistune versions

How to Mitigate CVE-2026-59922

Immediate Actions Required

Upgrade Mistune to version 3.3.0 or later in all applications and container images
Enforce a maximum request body size on endpoints that accept Markdown input
Apply per-request CPU and wall-clock timeouts around Mistune render calls
Disable the strikethrough, mark, and insert plugins if they are not required by the application

Patch Information

The issue is fixed in Mistune 3.3.0. See the GitHub Release v3.3.0, the GitHub Security Advisory GHSA-c8j7-8cv4-2xmq, and the remediation commit for full details.

Workarounds

Remove strikethrough, mark, and insert from the plugin list passed to mistune.create_markdown() until upgrade is possible
Deploy a reverse-proxy rule that rejects Markdown bodies exceeding a size threshold or containing excessive marker repetition
Run Markdown rendering in an isolated worker with strict CPU limits so a single malicious payload cannot exhaust the main service

bash

# Upgrade Mistune to the patched release
pip install --upgrade 'mistune>=3.3.0'

# Verify the installed version
python -c "import mistune; print(mistune.__version__)"

# Temporary workaround: create a Markdown renderer without the vulnerable plugins
python -c "import mistune; md = mistune.create_markdown(plugins=['table','url','task_lists']); print(md('# ok'))"