Lucene search
+L

2 matches found

Github Security Blog
Github Security Blog
added 2026/07/20 9:34 p.m.14 views

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

Summary Type: Algorithmic-complexity denial of service. A run of N closed pairs xx... or the analogous ==x== for mark, ^^x^^ for insert causes ON² work in the formatting parser. With the strikethrough, mark, or insert plugin enabled, an 8 KB input pegs the CPU for 4 seconds; 16 KB → 17 seconds...

7.5CVSS5.3AI score0.00418EPSS
SaveExploits1References6Affected Software1
Github Security Blog
Github Security Blog
added 2026/07/20 9:32 p.m.9 views

Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Summary Type: Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed x strong or x strong-emphasis combined pairs causes ON² parser work. Distinct from the bracket-bomb DoS repetition and from the formatting-plugin DoS /==/^^; this one fires on default-config mistune...

7.5CVSS5.4AI score0.0041EPSS
SaveExploits1References6Affected Software1
Rows per page
Query Builder