Mistune Markdown library quadratic-time DoS via emphasis delimiters
A Python text converter can be stalled by tiny messages.
Summary
Mistune's Markdown library can be made to use CPU for seconds with a small document, stalling the work it runs. Versions 3.3.0 or later, before 3.3.4, are affected.
What to do
Update mistune to 3.3.4 or later.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen