Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T16:24:37 mistune: Mistune: Denial of Service via unbounded recursion in Markdown include directive 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-835

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.

A flaw was found in Mistune, a Python Markdown parser. The Include directive in Mistune's `src/mistune/directives/include.py` does not properly detect indirect cycles when two Markdown files include each other. This oversight allows for unbounded recursion, which can lead to a `RecursionError` and crash the rendering request, resulting in a Denial of Service (DoS) for the application using the parser.

This flaw in the Mistune Include directive can cause a denial of service when an application explicitly enables the Include plugin and renders user-controlled Markdown files from disk. Exploitation requires an attacker to place at least two coordinated Markdown files on the include search path; default Mistune configurations that parse inline strings without the Include plugin are not affected. To mitigate this issue, Red Hat recommends avoiding the processing of untrusted Markdown content that may contain recursively linked include directives. Users should ensure that any Markdown files processed by applications utilizing Mistune are from trusted sources or are thoroughly sanitized to prevent indirect cyclic inclusions. Migration Toolkit for Applications 8 Fix deferred mta/mta-solution-server-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Under investigation python-mistune Red Hat Satellite 6 Under investigation satellite/iop-advisor-engine-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-59927 https://nvd.nist.gov/vuln/detail/CVE-2026-59927 https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993 https://github.com/lepture/mistune/releases/tag/v3.3.0 https://github.com/lepture/mistune/security/advisories/GHSA-8mpj-m6qm-5qr8