Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-59922
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-08 Jul, 2026 | 16:12
Updated At-09 Jul, 2026 | 14:40
Rejected At-
▼CVE Numbering Authority (CNA)
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

Affected Products
Vendor
lepture
Product
mistune
Versions
Affected
  • < 3.3.0
Problem Types
TypeCWE IDDescription
CWECWE-407CWE-407: Inefficient Algorithmic Complexity
CWECWE-1333CWE-1333: Inefficient Regular Expression Complexity
Type: CWE
CWE ID: CWE-407
Description: CWE-407: Inefficient Algorithmic Complexity
Type: CWE
CWE ID: CWE-1333
Description: CWE-1333: Inefficient Regular Expression Complexity
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq
x_refsource_CONFIRM
https://github.com/lepture/mistune/commit/96d0f57f8fe9eeb06bb4cff521962a27d7c402e7
x_refsource_MISC
https://github.com/lepture/mistune/releases/tag/v3.3.0
x_refsource_MISC
Hyperlink: https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/lepture/mistune/commit/96d0f57f8fe9eeb06bb4cff521962a27d7c402e7
Resource:
x_refsource_MISC
Hyperlink: https://github.com/lepture/mistune/releases/tag/v3.3.0
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq
exploit
Hyperlink: https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq
Resource:
exploit
Details not found