Skip to content
OpenAdvisories
High · 7.5 CVE-2026-76098 EUVD-2026-65137GHSA-6m44-fpc8-c3rqPYSEC-2026-3863

Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

Published Aug 24, 2026 · Updated Aug 24, 2026 · Assigned by GitHub_M

Description

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3

Affected products

VendorProductAffectedFixed
lepture mistune >= 3.3.0, < 3.3.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 mistune No fix yet —
Debian 13 mistune No fix yet —
Debian 12 mistune No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 mistune No fix yet —
Ubuntu 26.04 LTS mistune No fix yet —
Ubuntu 24.04 LTS mistune No fix yet —
Ubuntu 22.04 LTS mistune No fix yet —
Ubuntu 20.04 LTS mistune No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS mistune No fix yet —
Ubuntu 16.04 LTS mistune No fix yet —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3-mistune 0.8.3-14.amzn2023.0.4 ALAS2023-2026-2148

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-mistune 3.3.4-1 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI mistune >= 3.3.0, < 3.3.3 3.3.3 GHSA-6m44-fpc8-c3rq

Advisories 1

References