https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T11:27:22.956220+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2026-59925 BREW-adr-viewer-CVE-2026-59925 — Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs 2026-10-04T11:27:23.180207+00:00

Affected: Homebrew: adr-viewer

## Summary

**Type:** Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed `**x**` (strong) or `***x***` (strong-emphasis combined) pairs causes O(N²) parser work. Distinct from the bracket-bomb DoS (`[` repetition) and from the formatting-plugin DoS (`~~`/`==`/`^^`); this one fires on default-config mistune with no plugins required. **File:** `src/mistune/inline_parser.py` lines 41-48 (the `EMPHASIS_END_RE` family) and the surrounding emphasis dispatch. **Root cause:** for every opening run of `*`s the parser scans forward using one of `EMPHASIS_END_RE['*']` / `['**']` / `['***']` to find the matching close. Each scan is bounded per call, but the parser invokes the scan from every potential start position. For input shaped `**x**` repeated N times, every `**` is treated as a potential start, each scan can cover up to the end of input. Total work is O(N²). The triple-emphasis variant `***x***` is slightly worse due to the extra alternation between `*`, `**`, and `***` close patterns. Reproducible against default mistune with no plugins.

## Affected Code

**File:** `src/mistune/inline_parser.py`, lines 41-48.

```python EMPHASIS_END_RE = { "*": re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\\*|[^\s*])\*(?!\*)"), "_": re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\_|[^\s_])_(?!_)\b"), "**": re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\\*|[^\s*])\*\*(?!\*)"), "__": re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\_|[^\s_])__(?!_)\b"), "**…

 https://cve.radiocsirt.org/vuln/euvd-2026-334063 EUVD-2026-334063 2026-10-04T11:27:23.180306+00:00 EUVD-2026-334063 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59925 fkie_cve-2026-59925 2026-10-04T11:27:23.180324+00:00

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

 https://cve.radiocsirt.org/vuln/ghsa-4j32-57v6-6g45 GHSA-4j32-57v6-6g45 — Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs 2026-10-04T11:27:23.180348+00:00

Affected: PyPI: mistune

## Summary

**Type:** Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed `**x**` (strong) or `***x***` (strong-emphasis combined) pairs causes O(N²) parser work. Distinct from the bracket-bomb DoS (`[` repetition) and from the formatting-plugin DoS (`~~`/`==`/`^^`); this one fires on default-config mistune with no plugins required. **File:** `src/mistune/inline_parser.py` lines 41-48 (the `EMPHASIS_END_RE` family) and the surrounding emphasis dispatch. **Root cause:** for every opening run of `*`s the parser scans forward using one of `EMPHASIS_END_RE['*']` / `['**']` / `['***']` to find the matching close. Each scan is bounded per call, but the parser invokes the scan from every potential start position. For input shaped `**x**` repeated N times, every `**` is treated as a potential start, each scan can cover up to the end of input. Total work is O(N²). The triple-emphasis variant `***x***` is slightly worse due to the extra alternation between `*`, `**`, and `***` close patterns. Reproducible against default mistune with no plugins.

## Affected Code

**File:** `src/mistune/inline_parser.py`, lines 41-48.

```python EMPHASIS_END_RE = { "*": re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\\*|[^\s*])\*(?!\*)"), "_": re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\_|[^\s_])_(?!_)\b"), "**": re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\\*|[^\s*])\*\*(?!\*)"), "__": re.compile(r"(?:" + PREVENT_BACKSLASH + r"\\_|[^\s_])__(?!_)\b"), "**…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-59925 msrc_CVE-2026-59925 — inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs 2026-10-04T11:27:23.180404+00:00 msrc_CVE-2026-59925 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21339-1 openSUSE-SU-2026:21339-1 — Security update for python-mistune 2026-10-04T11:27:23.180423+00:00

Security update for python-mistune

 https://cve.radiocsirt.org/vuln/pysec-2026-2213 PYSEC-2026-2213 2026-10-04T11:27:23.180444+00:00

Affected: PyPI: mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

 https://cve.radiocsirt.org/vuln/suse-su-2026:22655-1 SUSE-SU-2026:22655-1 — Security update for python-mistune 2026-10-04T11:27:23.180464+00:00

Security update for python-mistune

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59925 UBUNTU-CVE-2026-59925 2026-10-04T11:27:23.180484+00:00

Affected: Ubuntu:16.04:LTS: mistune, Ubuntu:18.04:LTS: mistune, Ubuntu:20.04:LTS: mistune, Ubuntu:22.04:LTS: mistune, Ubuntu:24.04:LTS: mistune, Ubuntu:25.10: mistune, Ubuntu:26.04:LTS: mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.