Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character cau…

CVE-2026-59922 affects Mistune, a Python Markdown parser, in versions prior to 3.3.0. The vulnerability exists in src/mistune/plugins/formatting.py where the strikethrough, mark, or insert plugins scan for matching markers (tilde, equals-sign, or caret) from each possible start position. A specially crafted input using closed marker pairs around a character triggers quadratic computational work, leading to CPU exhaustion and denial of service. This is a ReDoS-style algorithmic complexity vulnerability. The issue was fixed in Mistune version 3.3.0. Users are advised to upgrade immediately to mitigate the risk of service disruption through maliciously crafted Markdown input.