CVE-2026-76098 - Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
Brief
CVE ID : CVE-2026-76098
Published : Aug. 24, 2026, 8:17 p. m.
- 54 minutes ago
Description : Mistune is a Python Markdown parser with renderers and plugins. Versions 3.
- 0 through 3.
- 2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.
render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.
- 3
Severity: 7.5
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...