High severity · published Aug 24, 2026
CVE-2026-76098
Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
mistune · lepture
>= 3.3.0, < 3.3.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76098
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76098
github.com
https://github.com/lepture/mistune/commit/0938fb7
github.com
https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq
More from mistune
8.6
CVE-2026-115353
Mistune before 3.3.0 Path Traversal via include Directive
7.5
CVE-2026-115355
Mistune before 3.3.0 Path Traversal and XSS via Include Directive
7.5
CVE-2026-115352
Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
7.5
CVE-2026-115349
Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
7.5
CVE-2026-115348
Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text