CVE-2026-121437 Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters

Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "ab" to trigger an On² index-fixup loop, stalling...

CVE-2026-121437

Mistune versions 3.3.0 before 3.3.4 are vulnerable to a Denial of Service (DoS) attack due to a quadratic-time complexity issue in the _process_emphasis_delimiters function. Remote attackers can exhaust CPU resources by submitting small Markdown documents containing specific repeated patterns, su...