CVE-2026-97699

waiting for further signals

GHSA-ww7q-mxrj-5ffg ↗

no check availablenot proven exploitable

awaiting cvepublic poc−1.8dkev

pip:mistune < 3.3.4

fixed in 3.3.4

CWE-400 Uncontrolled Resource Consumption

ETK-2026-2054, permanent identifier

pkg:pypi/mistune

cvss7.5cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

1d 19h 06msince last run

16mAI analysis

timeline

0 = cve.org, not yet published

waiting for further signals−43h06mtrigger signal −42h38mpublic poc−42h38m

−36h

−24h

−12h

description

Mistune versions before 3.3.4 can consume excessive CPU while parsing certain inline-image Markdown input. An attacker needs a way to submit Markdown that the application renders, potentially causing worker stalls or reduced service availability.

mitigation

Upgrade mistune to version 3.3.4 or later. Until upgraded, restrict untrusted Markdown rendering and enforce request, input-size, and processing-time limits.

fixed in 3.3.4

check

exploit

automation

–

auth required

EPSS

–

agent run time

16m

cve.org record, t = 0

not published yet

Δ to public poc

−1.8d

Δ to kev

–

outcome

No artifact: an exploit or check was attempted but could not be produced at this moment.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-19 11:05Z
ghsa: trigger signal, started the run
https://github.com/lepture/mistune/security/advisories/GHSA-ww7q-mxrj-5ffg
2026-10-19 11:05Z
public poc
https://github.com/lepture/mistune/security/advisories/GHSA-ww7q-mxrj-5ffg

this entry in the feed

GET /api/v1/feed/CVE-2026-97699

{
  "etk_id": "ETK-2026-2054",
  "cve_id": "CVE-2026-97699",
  "display_id": "CVE-2026-97699",
  "ghsa_id": "GHSA-ww7q-mxrj-5ffg",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Quadratic parsing denial of service in mistune",
  "summary": "Mistune versions before 3.3.4 can consume excessive CPU while parsing certain inline-image Markdown input. An attacker needs a way to submit Markdown that the application renders, potentially causing worker stalls or reduced service availability.",
  "mitigation": "Upgrade mistune to version 3.3.4 or later. Until upgraded, restrict untrusted Markdown rendering and enforce request, input-size, and processing-time limits.",
  "vendor": "pip",
  "product": "pip:mistune",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 3.3.4"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "3.3.4"
      ],
      "package_name": "mistune",
      "purl": "pkg:pypi/mistune"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.204363416666666,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-19T11:05:05+00:00",
      "days": -1.7763272845023148,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:42:59.718593+00:00",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-ww7q-mxrj-5ffg"
    },
    "trigger_signal": {
      "at": "2026-10-19T11:05:05+00:00",
      "days": -1.7763272845023148,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:42:59.718593+00:00",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-ww7q-mxrj-5ffg"
    }
  }
}

published 2026-10-19 11:44Z
last change 2026-10-21 05:31Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.