CVE-2026-59925: inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Vulnerability summary

CVE-2026-59925 is a high (CVSS 7.5) Inefficient Algorithmic Complexity vulnerability in lepture mistune. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 50.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 08-07-2026
   PublishedVulnerability first disclosed.
2. 08-07-2026
   Last modifiedVulnerability information updated.

Description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

• CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
• CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.