https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T11:24:26.923076+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2026-59922 BREW-adr-viewer-CVE-2026-59922 — Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough… 2026-10-04T11:24:26.931578+00:00

Affected: Homebrew: adr-viewer

## Summary

**Type:** Algorithmic-complexity denial of service. A run of N closed pairs `~~x~~~~x~~...` (or the analogous `==x==` for `mark`, `^^x^^` for `insert`) causes O(N²) work in the formatting parser. With the `strikethrough`, `mark`, or `insert` plugin enabled, an 8 KB input pegs the CPU for ~4 seconds; 16 KB → ~17 seconds. **File:** `src/mistune/plugins/formatting.py`, lines 13-15 (the `_STRIKE_END` / `_MARK_END` / `_INSERT_END` patterns and their per-position scan). **Root cause:** for each opening `~~`/`==`/`^^` the parser scans forward for the matching close pattern. The scan itself uses a bounded regex, but the parser tries the close-scan at every potential start position. For input shaped like `~~x~~` repeated N times, every `~~` is examined as a possible start, each scan covers up to the end of input. Total work is O(N²). Default config without these plugins handles the same input in linear time (4 ms for 4000 reps), confirming the cost is in the formatting plugin's per-marker scan, not in core parsing.

## Affected Code

**File:** `src/mistune/plugins/formatting.py`, lines 12-16.

```python _STRIKE_END = re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\~|[^\s~])~~(?!~)") _MARK_END = re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\=|[^\s=])==(?!=)") _INSERT_END = re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\\^|[^\s^])\^\^(?!\^)") # Each pattern is scanned forward from every start position fired by the # corresponding inline rule. The end-pattern itself is bounded; the…

 https://cve.radiocsirt.org/vuln/euvd-2026-335363 EUVD-2026-335363 2026-10-04T11:24:26.931691+00:00 EUVD-2026-335363 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59922 fkie_cve-2026-59922 2026-10-04T11:24:26.931710+00:00

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

 https://cve.radiocsirt.org/vuln/ghsa-c8j7-8cv4-2xmq GHSA-c8j7-8cv4-2xmq — Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough… 2026-10-04T11:24:26.931736+00:00

Affected: PyPI: mistune

## Summary

**Type:** Algorithmic-complexity denial of service. A run of N closed pairs `~~x~~~~x~~...` (or the analogous `==x==` for `mark`, `^^x^^` for `insert`) causes O(N²) work in the formatting parser. With the `strikethrough`, `mark`, or `insert` plugin enabled, an 8 KB input pegs the CPU for ~4 seconds; 16 KB → ~17 seconds. **File:** `src/mistune/plugins/formatting.py`, lines 13-15 (the `_STRIKE_END` / `_MARK_END` / `_INSERT_END` patterns and their per-position scan). **Root cause:** for each opening `~~`/`==`/`^^` the parser scans forward for the matching close pattern. The scan itself uses a bounded regex, but the parser tries the close-scan at every potential start position. For input shaped like `~~x~~` repeated N times, every `~~` is examined as a possible start, each scan covers up to the end of input. Total work is O(N²). Default config without these plugins handles the same input in linear time (4 ms for 4000 reps), confirming the cost is in the formatting plugin's per-marker scan, not in core parsing.

## Affected Code

**File:** `src/mistune/plugins/formatting.py`, lines 12-16.

```python _STRIKE_END = re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\~|[^\s~])~~(?!~)") _MARK_END = re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\=|[^\s=])==(?!=)") _INSERT_END = re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\\^|[^\s^])\^\^(?!\^)") # Each pattern is scanned forward from every start position fired by the # corresponding inline rule. The end-pattern itself is bounded; the…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-59922 msrc_CVE-2026-59922 — Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough… 2026-10-04T11:24:26.931796+00:00 msrc_CVE-2026-59922 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21339-1 openSUSE-SU-2026:21339-1 — Security update for python-mistune 2026-10-04T11:24:26.931815+00:00

Security update for python-mistune

 https://cve.radiocsirt.org/vuln/pysec-2026-2210 PYSEC-2026-2210 2026-10-04T11:24:26.931836+00:00

Affected: PyPI: mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

 https://cve.radiocsirt.org/vuln/suse-su-2026:22655-1 SUSE-SU-2026:22655-1 — Security update for python-mistune 2026-10-04T11:24:26.931856+00:00

Security update for python-mistune

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59922 UBUNTU-CVE-2026-59922 2026-10-04T11:24:26.931876+00:00

Affected: Ubuntu:16.04:LTS: mistune, Ubuntu:18.04:LTS: mistune, Ubuntu:20.04:LTS: mistune, Ubuntu:22.04:LTS: mistune, Ubuntu:24.04:LTS: mistune, Ubuntu:25.10: mistune, Ubuntu:26.04:LTS: mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.