Denial of Service Vulnerability in Mistune Python Markdown Parser

CVE-2026-76098

What is CVE-2026-76098?

The Mistune Python Markdown parser versions 3.3.0 through 3.3.2 are susceptible to a Denial of Service (DoS) attack due to their handling of deeply nested tokens. When processing Markdown with consecutive asterisk characters, Mistune can create deeply nested emphasis tokens during HTML rendering. This leads to recursive token rendering in the HTMLRenderer.render_token() method, which may exceed Python's recursion limit, resulting in a RecursionError and potentially crashing the parsing process. Users are encouraged to upgrade to version 3.3.3 or later to mitigate this vulnerability.

References