CVE-2026-59922

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from ea...

CVE-2026-59922

Mistune (Python Markdown parser) contains a quadratic-time DoS in formatting.py for long runs of marker pairs (x , ==x==, ^^x^^) in the strikethrough/mark/insert plugins. The issue arises from scanning for matching markers from every possible start position, causing CPU exhaustion. It is fixed in...