CVE-2026-76098: Mistune Python Markdown Parser DoS Vulnerability

CVE-2026-76098 Overview

CVE-2026-76098 is a denial-of-service vulnerability in Mistune, a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 fail to bound recursion when rendering emphasis tokens generated from consecutive asterisk characters. An attacker who submits crafted Markdown input can trigger a RecursionError in HTMLRenderer.render_token() and crash the parsing process. The issue is fixed in version 3.3.3. This weakness is categorized as [CWE-674] Uncontrolled Recursion.

Critical Impact
Remote, unauthenticated attackers can crash any service that renders untrusted Markdown through Mistune, disrupting availability of dependent applications.

Affected Products

Mistune 3.3.0
Mistune 3.3.1
Mistune 3.3.2

Discovery Timeline

2026-08-24 - CVE-2026-76098 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-76098

Vulnerability Analysis

Mistune converts consecutive asterisk characters in Markdown source into nested emphasis tokens. The HTML renderer then walks that token tree recursively in HTMLRenderer.render_token(). Because no upper bound existed on emphasis nesting depth, an attacker could produce input that generates a token tree deeper than Python's default recursion limit.

When rendering reaches the limit, Python raises RecursionError, and the parsing process aborts. Any web service, static site generator, chat bot, or documentation pipeline that accepts external Markdown becomes a viable target. The attack requires no authentication and no user interaction.

Root Cause

The root cause is uncontrolled recursion during token rendering. Mistune's inline parser produced arbitrarily nested emphasis nodes from repeated asterisks, and the renderer descended each level with a Python function call. Without a max_emphasis_depth guard, adversary-controlled input dictated call-stack depth.

Attack Vector

An attacker sends Markdown containing a long run of asterisk characters to any endpoint that parses input with Mistune. Rendering triggers deep recursion and terminates the worker with RecursionError. Repeated requests exhaust process availability.

python

# Security patch in src/mistune/inline_parser.py
_REGEX_META_CHARS = set(r"()[]{}?*+|.^$")
_CHARREF_PREFIX = re.compile(r"(#[0-9]{1,7};|#[xX][0-9a-fA-F]+;|[^\t\n\f <&#;]{1,32};)")
DEFAULT_MAX_EMPHASIS_DEPTH = 20

AUTO_EMAIL = (
    r"""<[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9]"""
)

Source: GitHub commit 0938fb7. The patch introduces DEFAULT_MAX_EMPHASIS_DEPTH = 20, capping emphasis nesting during inline parsing so the renderer cannot exceed Python's recursion limit.

Detection Methods for CVE-2026-76098

Indicators of Compromise

Application logs containing RecursionError: maximum recursion depth exceeded originating from mistune/renderers/html.py or HTMLRenderer.render_token.
Worker or container restarts correlated with HTTP requests that carry Markdown payloads containing long runs of asterisk characters.
Sudden spikes in 5xx responses from endpoints that accept Markdown input.

Detection Strategies

Inspect HTTP request bodies for Markdown fields containing more than 20 consecutive * or _ characters and alert on outliers.
Instrument Python services with structured exception logging so RecursionError events surface in the SIEM with the offending request identifier.
Track the installed version of Mistune across build artifacts and container images using software composition analysis to flag any release earlier than 3.3.3.

Monitoring Recommendations

Forward application exception telemetry into the Singularity Data Lake and alert on RecursionError bursts originating from Markdown rendering paths.
Baseline request-body size and asterisk-character density for Markdown endpoints and alert on statistical deviation.
Monitor process crash and restart rates on worker fleets that handle user-supplied Markdown content.

How to Mitigate CVE-2026-76098

Immediate Actions Required

Upgrade Mistune to version 3.3.3 in every application, container image, and Python virtual environment.
Rebuild and redeploy dependent services and confirm the pinned version through pip show mistune.
Add request-body size limits and Markdown input validation at the reverse proxy or API gateway.

Patch Information

The fix is delivered in Mistune 3.3.3. The change adds DEFAULT_MAX_EMPHASIS_DEPTH = 20 in src/mistune/inline_parser.py, bounding emphasis nesting so HTMLRenderer.render_token() cannot exceed Python's recursion limit. Review the GitHub Security Advisory GHSA-6m44-fpc8-c3rq and the upstream commit for full details.

Workarounds

Reject Markdown input containing more than 20 consecutive emphasis characters at the application edge.
Run Mistune rendering inside a subprocess or worker with a strict timeout and automatic restart to contain crashes.
Lower Python's recursion limit intentionally with sys.setrecursionlimit() only if the application tolerates a stricter ceiling on nesting.

bash

# Configuration example: upgrade to the patched release
pip install --upgrade 'mistune>=3.3.3'
pip show mistune | grep -i version