{"id":"CVE-2026-121437","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-121437","summary":"Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers…","details":"Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like \"*a_b\" to trigger an O(n²) index-fixup loop, stalling workers for seconds.","published":"2026-11-03T15:17:35.147","modified":"2026-11-03T15:17:35.280","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/lepture/mistune/commit/b4dd3284e52ec741ed9a227db29ade9017828e90","label":"lepture/mistune@b4dd328"},"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/commit/b4dd3284e52ec741ed9a227db29ade9017828e90"},{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-qp42-r9j6-83g9"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/mistune-3.3.0-before-3.3.4-quadratic-time-dos-via-process-emphasis-delimiters"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-03T15:17:35.280"}}