CVE-2026-76098

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-76098
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76098.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-76098
Aliases
  • GHSA-6m44-fpc8-c3rq
Downstream
Published
2026-08-24T20:05:00.932Z
Modified
2026-08-27T11:47:35.122562090Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
Details

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76098.json",
    "cwe_ids": [
        "CWE-674"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/lepture/mistune

Affected ranges

Type
GIT
Repo
https://github.com/lepture/mistune
Events
Introduced
15c3b79325125272263d7d42492ec8f757447191
Fixed
060f73ac87e8cf6d9e9b48f2df28c0654d845a4c
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.3.3"
        }
    ]
}

Affected versions

v3.*
v3.3.0
v3.3.1
v3.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76098.json"