CVE-2026-76098— Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
Quick assessment
Affected
lepture mistune
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mistune 是一个支持渲染器和插件的 Python Markdown 解析器。版本 3.3.0 至 3.3.2 存在通过深层嵌套令牌（tokens）导致的拒绝服务（DoS）漏洞。在 HTML 渲染过程中，连续的星号字符会生成深层嵌套的强调（emphasis）令牌；而 HTMLRenderer.render_token() 中的递归渲染处理可能导致超出 Python 的递归限制，从而引发 RecursionError 异常，使得构造的恶意 Markdown 内容能够导致解析过程崩溃。该问题已在版本 3.3.3 中
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76098
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
Source: CVE Program / CVE List V5
Vulnerability Description
Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-76098
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 10642 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-76098
请登录查看更多情报信息。
Other References for CVE-2026-76098 (2)
IV. Related Vulnerabilities
Same product: mistune
-
CVE-2026-59927
Mistune directives/include: mutual `.. include::` recursion -
CVE-2026-59928
Mistune block_parser: quadratic-time parsing on long lists o -
CVE-2026-59924
Mistune: Arbitrary File Read via Include directive path trav -
CVE-2026-59929
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list miss -
CVE-2026-59925
inline_parser: quadratic-time parsing on long runs of `**x**
Same vendor: lepture
-
CVE-2026-59927
Mistune directives/include: mutual `.. include::` recursion -
CVE-2026-59928
Mistune block_parser: quadratic-time parsing on long lists o -
CVE-2026-59924
Mistune: Arbitrary File Read via Include directive path trav -
CVE-2026-59929
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list miss -
CVE-2026-59925
inline_parser: quadratic-time parsing on long runs of `**x**
Same weakness: CWE-674
-
CVE-2026-16781
SVG File Parsing Stack Exhaustion Vulnerability in Autodesk -
CVE-2026-9769
justhtml before 1.10.0 Denial of Service via deeply nested H -
CVE-2026-66393
NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder -
CVE-2026-63462
Unleash: Unauthenticated single-request DoS via OpenAPI vali -
CVE-2026-54623
django CMS: Plugin move endpoint allows cyclic reparenting (
V. Comments for CVE-2026-76098
No comments yet