PT-2026-81027 · Pypi · Mistune
CVE-2026-76098
·
Published
2026-08-24
·
Updated
2026-09-10
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Mistune versions 3.3.0 through 3.3.2
Description
This issue allows a Denial of Service (DoS) through deeply nested tokens. When rendering HTML, consecutive asterisk characters can create deeply nested emphasis tokens. The recursive rendering process in the
render token() function of the HTMLRenderer can exceed Python's recursion limit and trigger a RecursionError, which allows specially crafted Markdown to crash the parsing process.Recommendations
Update to version 3.3.3.
Exploit
Fix
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mistune