PT-2026-59302 · Pypi · Mistune
Published
2026-07-13
·
Updated
2026-07-13
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Summary
Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse link text. A relatively small input consisting of repeated [ characters causes significant parsing slowdown.
Affected component
mistune/inline parser.py → parse link text
Description
When parsing Markdown containing many consecutive [ characters, parse link text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior.
An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload.
Root cause
The vulnerability stems from a two-loop interaction:
- The outer loop in
InlineParser.parse()(inline parser.py) advances only 1 character at a time when parse link() returns None - Each failed attempt calls
parse link text()which performs an O(n) scan to the end of the string looking for a closing] - With n consecutive
[characters, this results in O(n) × O(n) = O(n²) total work
PoC
Run below python script
import mistune
import time
md = mistune.create markdown()
s = "[" * 6400
t = time.perf counter()
md(s)
print(time.perf counter() - t)Benmark poc
Run below code for benchmark
import mistune
import time
md = mistune.create markdown()
sizes = [100,200,400,800,1600,3200,6400]
for n in sizes:
s = "[" * n
t0 = time.perf counter()
md(s)
dt = time.perf counter() - t0
print(f"{n:6d} {dt:.6f}")Observed behaviour
python3 benchmark.py
100 0.001609
200 0.003207
400 0.012906
800 0.050220
1600 0.197307
3200 0.801172
6400 3.190393Execution time grows superlinearly, consistent with O(n²) complex
Impact
This can be used as a denial-of-service attack in any application that parses user-supplied Markdown using Mistune, including:
- Web applications (comments, posts, content rendering)
- API services processing Markdown
- Documentation rendering systems
- A small (~6 KB) payload can block CPU for multiple seconds.
Suggested fix
Return the furthest scanned position from parse link text even on failure, so the outer loop can skip ahead instead of advancing 1 character at a time
Security Classification
CWE-400: Uncontrolled Resource Consumption
Denial of Service (CPU exhaustion)
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mistune