CVE-2026-121437 in Mistune
Summary
by MITRE • 11/03/2026
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "*a_b" to trigger an O(n²) index-fixup loop, stalling workers for seconds.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in the Mistune library, specifically affecting versions from 3.3.0 up to but not including 3.3.4, represents a significant security risk due to its potential for causing denial of service through algorithmic complexity attacks. This flaw is rooted in how the markdown parser processes emphasis delimiters, such as asterisks and underscores used to denote italics or bold text within markdown documents. The core technical issue lies in an inefficient implementation of index-fixup logic during the parsing phase. When the parser encounters specific patterns of nested or repeated emphasis markers, it enters a computational loop that scales quadratically with respect to the input size. This means that as the length of the maliciously crafted document increases, the processing time does not grow linearly but rather squares, leading to exponentially longer execution times for relatively small inputs.
From an industry standard perspective, this vulnerability is classified under CWE-400, which denotes Uncontrolled Resource Consumption. More specifically, it aligns with CWE-675, Operations on Input with Inefficient Algorithmic Complexity, as the flaw allows attackers to trigger performance degradation through carefully constructed input rather than exploiting a traditional buffer overflow or logic error in data handling. The attack vector is remote and requires only that an attacker can submit markdown content for parsing by a service utilizing this library. By submitting small but strategically designed documents containing repeated patterns such as asterisk-a-underscore-b, the parser's internal state machine becomes trapped in a quadratic-time loop. This behavior effectively stalls worker threads or processes responsible for rendering the content, leading to resource exhaustion on the host system.
The operational impact of this vulnerability is severe for any service that accepts user-generated markdown input and renders it dynamically. Since web applications often use thread pools or asynchronous workers to handle concurrent requests, a single malicious request can consume significant CPU resources for several seconds. If an attacker sends multiple such requests simultaneously, they can exhaust the available computational capacity of the server, causing legitimate users' requests to time out or fail. This constitutes a classic denial of service scenario where availability is compromised without requiring authentication or privilege escalation. The efficiency of this attack means that even modest hardware resources can be overwhelmed by minimal traffic from an attacker, making it a highly effective and low-cost vector for disrupting services.
To mitigate this risk, organizations relying on Mistune must immediately upgrade to version 3.3.4 or later, where the quadratic-time complexity in emphasis delimiter processing has been addressed through algorithmic optimization. For environments that cannot patch instantly due to dependency constraints, defensive measures should include implementing strict rate limiting on markdown parsing endpoints and enforcing size limits on incoming documents. Additionally, integrating a Web Application Firewall with rules capable of detecting patterns indicative of this specific attack vector can provide an additional layer of defense by blocking requests containing the characteristic repeated emphasis markers before they reach the application logic. Monitoring CPU usage spikes correlated with markdown processing tasks can also aid in early detection and response to ongoing exploitation attempts.