---
id: CVE-2026-76098
title: Mistune is a Python Markdown parser with renderers and plugins
summary: >-
  Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0
  through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML
  rendering creates deeply nested emphasis tokens from consecutive asterisk
  characters, a…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
vendor: mistune
product: mistune
affected:
  - 'mistune >= 3.3.0, < 3.3.3'
patched:
  - mistune 3.3.3
published: '2026-08-24'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:06:39.057'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76098'
references:
  - url: 'https://github.com/lepture/mistune/commit/0938fb7'
    label: security-advisories@github.com
  - url: 'https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq'
    label: security-advisories@github.com
  - url: 'https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76098'
  - url: >-
      https://github.com/lepture/mistune/commit/0938fb781d0aded99de801b340ec1f8debeae5b2
  - url: 'https://github.com/lepture/mistune/releases/tag/v3.3.3'
  - url: 'https://github.com/advisories/GHSA-6m44-fpc8-c3rq'
  - url: 'https://github.com/lepture/mistune'
  - url: 'https://pypi.org/project/mistune'
tags:
  - nvd
  - ghsa
  - pip
  - osv
epss: 0.00278
epssPercentile: 0.2057
aliases:
  - GHSA-6m44-fpc8-c3rq
  - PYSEC-2026-3863
ecosystem: pip
ingestedAt: '2026-09-02T15:46:29.449Z'
---

## Overview

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-76098)

Affected packages:

- `mistune >= 3.3.0, < 3.3.3`

Patched in:

- `mistune 3.3.3`

Source: https://github.com/advisories/GHSA-6m44-fpc8-c3rq