Quick answers
- Is CVE-2026-59928 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59928 being exploited in the wild.
- How severe is CVE-2026-59928?
- High severity, with a CVSS score of 7.5, published 8 July 2026.
- Which products and versions are affected?
- mistune (PyPI) < 3.3.0, ECOSYSTEM:introduced=0,fixed=3.3.0.
- Is there a fix for CVE-2026-59928?
- Yes. mistune (PyPI): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-59928 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-59928?
- Check whether you run mistune (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mistune (PyPI): upgrade to 3.3.0 or later
pip install "mistune>=3.3.0"
Technical details
Mistune's block_parser.py contains an algorithmic complexity vulnerability (CWE-407/CWE-1333) where reference-link definitions are handled with O(N²) time complexity. The root cause is that the parser fails to amortize the scan for definition lists, performing redundant forward scans and normalization for every candidate position. An attacker can exploit this by submitting a Markdown document with thousands of repeated reference keys (e.g., '[a]: u\n'), causing the CPU to peg for several seconds per request. This is reachable via the default create_markdown() configuration. The issue is fixed in version 3.3.0 by implementing a single forward pass for line classification.
Affected products
- lepture mistune < 3.3.0
Identifiers
- CVE-2026-59928
- GHSA-ffq3-xpv3-j92q
- PYSEC-2026-2216
Timeline
- 2026-06-21: disclosed
- 2026-07-08: advisory: NVD publication date
- 2026-07-20: patched: GitHub Advisory reviewed and updated