Denial of Service Vulnerability in Mistune from Lepture

CVE-2026-121437

What is CVE-2026-121437?

Mistune versions prior to 3.3.4 have a vulnerability that can be exploited for denial of service, allowing remote attackers to execute a CPU-intensive attack. By submitting small markdown documents containing repetitive patterns, malicious users can trigger inefficient processing that leads to an O(n²) index-fixup loop, resulting in significant delays and resource exhaustion on the server. This opens the door for performance degradation, particularly in environments handling multiple requests.

References