CVE-2026-121437

Name of the Vulnerable Software and Affected Versions Mistune versions 3.3.0 through 3.3.3

Description A denial of service issue exists where remote attackers can exhaust CPU resources through quadratic-time emphasis delimiter processing. By submitting small markdown documents containing repeated patterns such as "*a b", an O(n²) index-fixup loop is triggered, which can stall workers for several seconds.

Recommendations Update Mistune to version 3.3.4 or later.