2 matches found
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
Summary Type: Algorithmic-complexity denial of service. A run of N closed pairs xx... or the analogous ==x== for mark, ^^x^^ for insert causes ON² work in the formatting parser. With the strikethrough, mark, or insert plugin enabled, an 8 KB input pegs the CPU for 4 seconds; 16 KB → 17 seconds...
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Summary Type: Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed x strong or x strong-emphasis combined pairs causes ON² parser work. Distinct from the bracket-bomb DoS repetition and from the formatting-plugin DoS /==/^^; this one fires on default-config mistune...