Description

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-24T20:17:19.330Z",
  "pubdate": "2026-08-24T20:17:19.330Z",
  "executiveSummary": "Mistune versions 3.3.0 through 3.3.2 are susceptible to a Denial of Service (DoS) vulnerability stemming from improper handling of deeply nested tokens during HTML rendering. The vulnerability arises when specially crafted Markdown input containing consecutive asterisk characters is processed, forcing the HTML renderer to generate deeply nested emphasis tokens.\nThe resulting impact of this flaw is the exhaustion of the Python call stack via recursive function execution within HTMLRenderer.render_token(), ultimately triggering an unhandled RecursionError and crashing the parsing process. This poses a significant availability risk for applications processing untrusted Markdown inputs, as unauthenticated remote attackers can reliably disrupt service operations with minimal overhead.\nExploitation requirements are low, as an attacker only needs the ability to supply malicious Markdown payloads to the vulnerable parsing pipeline. No special privileges or authentication mechanisms are required to trigger the crash. The risk implications include application downtime, potential resource exhaustion in multi-tenant environments, and service degradation for downstream systems relying on Mistune for text processing.",
  "technicalDetails": "The vulnerability resides within the HTML rendering component of Mistune, specifically inside the HTMLRenderer.render_token() method. The root cause is the lack of recursion depth limitation or iterative parsing logic when handling recursively nested syntactic structures, such as emphasis tokens generated by consecutive asterisk characters in Markdown input.\nWhen an attacker submits a crafted Markdown payload containing a high volume of tightly nested or chained asterisks, the parser constructs an excessively deep Abstract Syntax Tree (AST) of tokens. During the rendering phase, the HTMLRenderer.render_token() function recursively traverses this token hierarchy. Each nested token consumes a new frame on the Python interpreter's call stack.\nAs the recursion depth exceeds Python's default maximum recursion limit (sys.setrecursionlimit), the interpreter fails to allocate additional stack frames and raises a fatal RecursionError. Because this exception is not caught during the rendering process, it propagates upward and unconditionally terminates the execution of the host Python process.\nThe affected component is the HTML rendering module of Mistune, specifically versions 3.3.0 through 3.3.2. Network exposure depends on the architecture of the application utilizing Mistune; web applications exposing endpoints that accept and render user-supplied Markdown are directly exposed to remote exploitation. The attack requires no authentication or special privileges, allowing unauthenticated threat actors to repeatedly trigger the parsing failure and sustain a Denial of Service condition."
}