CVE-2026-121437
Description
A flaw was found in mistune. A remote attacker could cause a Denial of Service (DoS) by submitting specially crafted Markdown documents containing repeating emphasis delimiter patterns. Processing these patterns triggers an inefficient index-fixup loop that consumes excessive CPU resources and stalls application workers.
Statement
This vulnerability is rated Important for Red Hat products because an unauthenticated remote attacker can exhaust system resources and render services unresponsive by submitting malformed input to services that parse Markdown. In affected Red Hat OpenShift and AI environments where services parse user-supplied markup, handling repetitive delimiter sequences causes disproportionate CPU consumption that halts worker processes. Environments where Markdown rendering is restricted to authenticated, trusted users or where input parsing is not exposed over the network face significantly reduced exposure.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce parsing timeouts and execution budgets on delimiter processing within Mistune to abort quadratic-time Markdown parsing stalls: upgrade to mistune 3.3.4 (or the corresponding fixed Red Hat builds), which track and deactivate delimiters using a DelimiterIndex structure with a binary indexed tree and path compression instead of iterating across all delimiters on splice, closing crafted Markdown input with repeating emphasis delimiter patterns. Until patched, this is a concern on applications processing untrusted Markdown text with Mistune 3.3.0 through 3.3.3 on any platform, so restrict unauthenticated submission of untrusted Markdown documents to endpoints that parse content using affected Mistune versions. As a compensating measure, restrict maximum CPU execution time per worker process using RLIMIT_CPU to bound worker stall duration from quadratic delimiter loops. These controls limit blast radius and contain exploitation, but they do not fix the underlying algorithmic complexity denial-of-service defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
