CVE-2026-59925inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Descripción

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45 ExploitVendor Advisory
• https://github.com/lepture/mistune/commit/5de41fb8e527004dbc363e047a3c380c9288c74f Patch
• https://github.com/lepture/mistune/releases/tag/v3.3.0 Release Notes