Vulnerability record · CVE-2026-59922 · published 8 July 2026

CVE-2026-59922: Mistune project mistune inefficient regular expression (redos) vulnerability

Mistune Project · Mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

7.5 CVSS 3.1 High EPSS 0.64% · top 51.2% CWE-407 · CWE-407CWE-1333 · Inefficient regular expression (ReDoS)

7.5CVSS 3.1 base score

0.64%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References, 2 tagged exploit

9 Jul 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Mistune Mistune Project

References

Link	Tags
https://github.com/lepture/mistune/commit/96d0f57f8fe9eeb06bb4cff521962a27d7c402e7	Patch
https://github.com/lepture/mistune/releases/tag/v3.3.0	Release Notes
https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq	ExploitVendor Advisory
https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq	ExploitVendor Advisory

Track CVE-2026-59922 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-59925Mistune project mistune inefficient regular expression (redos) vulnerabilityMistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emph…EPSS 0.64%8 Jul 2026 7.5CVE-2026-59928Mistune project mistune inefficient regular expression (redos) vulnerabilityMistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-li…EPSS 0.65%8 Jul 2026 7.5CVE-2022-34749Mistune project mistune inefficient regular expression (redos) vulnerabilityIn mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on cert…EPSS 1.5%25 Jul 2022 6.1CVE-2026-59929Mistune project mistune cross-site scripting vulnerabilityMistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only java…EPSS 0.34%8 Jul 2026 6.1CVE-2026-59923Mistune project mistune cross-site scripting vulnerabilityMistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URI…EPSS 0.35%8 Jul 2026 6.1CVE-2026-44897Mistune project mistune cross-site scripting vulnerabilityMistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string-concaten…EPSS 0.27%26 May 2026 6.1CVE-2026-44898Mistune project mistune cross-site scripting vulnerabilityMistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a <ul> table-of-contents tree from a list of (…EPSS 0.27%26 May 2026 6.1CVE-2026-44899Mistune project mistune cross-site scripting vulnerabilityMistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options…EPSS 0.27%26 May 2026

Source: NIST National Vulnerability Database (record CVE-2026-59922), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.