CVE-2026-76098: Mistune Denial of Service via Excessive Emphasis Markers in Markdown
Summary
CVE-2026-76098: Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown. Affects mistune versions >= 3.3.0, < 3.3.3. Fixed in 3.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mistune is a popular Markdown parser for Python, widely used for converting Markdown text into HTML. It is known for its speed and flexibility, allowing developers to easily integrate Markdown rendering into their applications. However, a vulnerability has been identified in version 3.3.2 that exposes users to Denial of Service (DoS) attacks through excessive emphasis markers in Markdown input.
Vulnerability Detail
Mistune v3.3.2 contains a Denial of Service vulnerability that arises from uncontrolled recursion during the HTML rendering of deeply nested emphasis tokens. An attacker can exploit this by submitting Markdown with approximately 1,000 consecutive asterisk characters, leading to a crash of the Python process due to a RecursionError. The vulnerability is rooted in the InlineParser's method for processing emphasis delimiters, which creates excessive nesting levels that exceed Python's default recursion limit of 1000. This can disrupt services for all users sharing the same Python process, making it a significant risk for web applications that utilize user-generated content.
How To Fix
Latest published version: 3.4.0 as of 22 Oct 2026
pip install --upgrade "mistune==3.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.3
This is the first release that contains the fix.
pip install --upgrade "mistune==3.3.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a maximum nesting depth limit in your application. This can be done by modifying the emphasis parsing stage to treat excess emphasis markers as literal text when the limit is exceeded. Additionally, consider refactoring your HTML rendering approach to use an iterative stack-based method instead of recursion.
Conclusion
The vulnerability identified as CVE-2026-76098 in Mistune poses a significant risk due to its potential to cause Denial of Service attacks through excessive emphasis markers in Markdown. It is crucial for users of Mistune to update to the patched version or implement workarounds to protect their applications from this vulnerability.
See every vulnerability recorded for mistune →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Mistune versions from 3.3.0 to 3.3.2 are affected by this vulnerability. Version 3.3.3 and later have the issue fixed.
An attacker can exploit this vulnerability by submitting a specially crafted Markdown input containing a large number of consecutive asterisks, leading to a Denial of Service condition.
If you cannot update Mistune immediately, consider implementing a maximum nesting depth limit or using an iterative approach for rendering to mitigate the risk of a crash.
References
Related vulnerabilities
Recent vulnerabilities recorded for mistune.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
