Live › vulnerability › CVE-2026-121437
Mistune, a Python markdown parser, takes quadratic time on repeated emphasis delimiters such as "*a_b". A remote attacker can send small markdown documents that tie up CPU and stall worker processes for seconds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Applications that pass untrusted markdown to mistune 3.3.0 through 3.3.4 are exposed, because a single small document can consume a worker for seconds. Internal tools that only parse trusted content, or code that does not use mistune, can skip it.
No product ranges from the sources yet.
pip show mistune or python -c "import mistune; print(mistune.__version__)".3.3.4 (fixed version per the sources; any 3.3.x before 3.3.4 is affected).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "*a_b" to trigger an O(n²) index-fixup loop, stalling workers for seconds.
This page as .md · .json · in your agent: get_signal("CVE-2026-121437")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.