CVE-2026-59925

highCVSS 7.5covered by 2 sourcesfirst seen 2026-07-02

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

CSIRTS triage

What: This vulnerability causes quadratic-time parsing issues on long runs of emphasis pairs.
Who is affected: Users of Mistune are affected.
Urgency: Remediation is urgent due to the high severity of the vulnerability.
Action: Update to the latest version of Mistune to mitigate this issue.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-59925

Get an email if CVE-2026-59925 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.

Advisory coverage (2)

highCVE-2026-59925: Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences…nvd · 2026-07-08
highCVE-2026-59925: inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsmsrc · 2026-07-02

External references

NVD record for CVE-2026-59925

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-59925 status](https://www.csirts.com/badge/CVE-2026-59925)](https://www.csirts.com/cve/CVE-2026-59925)