Listen to this Post
How CVE-2026-59922 Works
Mistune is a Python Markdown parser that supports optional formatting plugins for strikethrough (~~), mark (==), and insert (^^) syntax. Prior to version 3.3.0, the formatting plugin suffers from an algorithmic complexity vulnerability that allows an attacker to cause CPU exhaustion with a relatively small payload.
The vulnerable code resides in src/mistune/plugins/formatting.py, specifically in the _STRIKE_END, _MARK_END, and `_INSERT_END` regular expression patterns. When the parser encounters a potential opening marker like ~~, it scans forward from that position to find a matching closing marker (~~). The regex itself is bounded, but the parser invokes this forward scan at every occurrence of ~~, ==, or `^^` in the input.
For an input constructed as `~~x~~` repeated N times, each of the N opening markers triggers a scan that can traverse up to the end of the input. This results in O(N²) total work — doubling the input size quadruples the processing time. The default configuration without these plugins processes the same input in linear time (e.g., 4 ms for 4000 repetitions), confirming that the cost is isolated to the formatting plugin’s per-marker scan.
The flaw is the same algorithmic-complexity class as certain backtracking issues in core parsing: a per-token retry loop without memoisation of failed positions. A proper delimiter-stack algorithm (as used in `commonmark-py` and markdown-it-py) would complete this work in O(N) total time.
An attacker can submit an 8 KB payload of the form `~~x~~~~x~~~~x~~…` to an application that uses Mistune with any of the strikethrough, mark, or `insert` plugins enabled. This causes the CPU to peg for approximately 4 seconds; a 16 KB payload extends this to ~17 seconds, and 32 KB to ~70 seconds. The attack consumes pure CPU time with no significant memory growth, making it a classic denial-of-service primitive.
Because the attack requires no authentication, is network-reachable, and has predictable scaling, it is rated as HIGH severity (CVSS 3.1 base score 7.5). The fix is available in Mistune version 3.3.0.
DailyCVE Form
Platform: ....... Python (Mistune) Version: ........ < 3.3.0 Vulnerability :.. Algorithmic Complexity DoS (CWE-407, CWE-1333) Severity: ....... HIGH (CVSS 3.1: 7.5) date: .......... 2026-07-08 Prediction: ..... 2026-07-20 (expected patch date)
What Undercode Say: Analytics
The following analytics and commands demonstrate the vulnerability and its impact.
PoC Verification ([email protected]):
import mistune, time
md = mistune.create_markdown(plugins=['strikethrough'])
for n in [500, 1000, 2000, 4000, 8000]:
s = '<del>x</del>' n
t = time.time()
md(s)
print(f'<del>x</del> {n} ({len(s)}b): {(time.time() - t) 1000:.0f}ms')
Observed Output (Python 3.13, Linux, 2.5GHz CPU):
<del>x</del> 500 (2500b): 19ms <del>x</del> 1000 (5000b): 71ms <del>x</del> 2000 (10000b): 272ms <del>x</del> 4000 (20000b): 1090ms <del>x</del> 8000 (40000b): 4302ms
Identical scaling for `mark` and `insert` plugins:
md = mistune.create_markdown(plugins=['mark'])
md('==x==' 4000) ~1100ms
md = mistune.create_markdown(plugins=['insert'])
md('^^x^^' 4000) ~1080ms
Baseline (no plugins, linear time):
md = mistune.create_markdown() no plugins
md('<del>x</del>' 4000) 4ms (1000x faster)
Exploit
- Prerequisite: Application uses Mistune with any of
strikethrough,mark, or `insert` plugins enabled (common for GitHub-Flavored Markdown compatibility). - Payload: `~~x~~` repeated N times (or
==x==,^^x^^). - Delivery: Attacker submits payload via any user-supplied Markdown input field.
- Effect: CPU spikes quadratically with input size; 8 KB → 4 sec, 16 KB → 17 sec, 32 KB → 70 sec.
- Scaling: A single request can exhaust a worker thread; concurrent requests overwhelm thread pools.
- No authentication required – network reachable, low attack complexity.
Protection
- Upgrade to Mistune 3.3.0 or later, which fixes the issue.
- If upgrading is not immediately possible, apply the suggested surgical patch to cap the number of simultaneously tracked unmatched markers (e.g.,
MAX_OPEN_MARKERS = 100) and treat excess markers as literal text. - Disable the
strikethrough,mark, and `insert` plugins if not strictly required. - Implement a regression test to ensure that `md(‘~~x~~’ 50_000)` completes in under 1 second.
- Deploy rate limiting and input size restrictions on Markdown processing endpoints to mitigate large payloads.
Impact
- Availability: High – CPU exhaustion leads to denial of service for legitimate users.
- Confidentiality: None – no data exposure.
- Integrity: None – no data alteration.
- Attack Vector: Network, unauthenticated, low complexity.
- Affected Versions: All Mistune releases prior to 3.3.0.
- Fixed Version: 3.3.0.
- CWE: CWE-407 (Inefficient Algorithmic Complexity) and CWE-1333 (Inefficient Regular Expression Complexity).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
