Source: mistune Version: 3.1.4-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for mistune. CVE-2026-76098[0]: | Mistune is a Python Markdown parser with renderers and plugins. | Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply | nested tokens. HTML rendering creates deeply nested emphasis tokens | from consecutive asterisk characters, and recursive rendering in | HTMLRenderer.render_token() can exceed Python's recursion limit and | raise RecursionError, allowing crafted Markdown to crash a parsing | process. This issue is fixed in version 3.3.3 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-76098 https://www.cve.org/CVERecord?id=CVE-2026-76098 [1] https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq [2] https://github.com/lepture/mistune/commit/0938fb781d0aded99de801b340ec1f8debeae5b2 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
