CVE-2026-76098

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...

CVE-2026-64209

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swingtbl and preemphasistbl are 4x4 arrays valid indices 0-3, but the boundary check uses " 4" instead of "= 4", allowing index 4 to cause an out-of-bounds...

DEBIAN-CVE-2026-64209

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swingtbl and preemphasistbl are 4x4 arrays valid indices 0-3, but the boundary check uses " 4" instead of "= 4", allowing index 4 to cause an out-of-bounds...

CVE-2026-64209 phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swingtbl and preemphasistbl are 4x4 arrays valid indices 0-3, but the boundary check uses " 4" instead of "= 4", allowing index 4 to cause an out-of-bounds...

CVE-2026-64209

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swingtbl and preemphasistbl are 4x4 arrays valid indices 0-3, but the boundary check uses " 4" instead of "= 4", allowing index 4 to cause an out-of-bounds...

GHSA-4J32-57V6-6G45 Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Summary Type: Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed x strong or x strong-emphasis combined pairs causes ON² parser work. Distinct from the bracket-bomb DoS repetition and from the formatting-plugin DoS /==/^^; this one fires on default-config mistune...

Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Summary Type: Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed x strong or x strong-emphasis combined pairs causes ON² parser work. Distinct from the bracket-bomb DoS repetition and from the formatting-plugin DoS /==/^^; this one fires on default-config mistune...

EUVD-2026-42335

Mistune inlineparser: quadratic-time parsing on long runs of x and x emphasis pairs...

SUSE CVE-2026-59925

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...

CVE-2026-59925

A flaw was found in Mistune, a Python Markdown parser. An attacker can exploit this vulnerability by providing specially crafted Markdown input containing long sequences of emphasis pairs. This can cause the parser to perform excessive computational work, leading to a denial of service DoS...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the inlineparser process. An attacker can cause excessive resource consumption by submitting input containing long sequences of double-asterisk or triple-asterisk emphasis pairs, leading to...

PYSEC-2026-2213

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...

DEBIAN-CVE-2026-59925

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...

PYSEC-2026-2213

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...

CVE-2026-59925

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...

CVE-2026-59925 inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...

CVE-2026-59925 inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...

CVE-2026-59925 inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...

CVE-2026-59925

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...

CVE-2026-59925

The CVE-2026-59925 affects Mistune, a Python Markdown parser. Before version 3.3.0, long sequences of well-formed emphasis markers (/x / or /x * around a character) trigger quadratic work in src/mistune/inline_parser.py by scanning for matching close markers from each opening run, enabling denial...