p PatchFirst

CVE-2026-59927

CVE-2026-59927 · Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.

CVSS 5.3 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • mistune

    Versions
    • < 3.3.0: Affected

    No fix published

  • mistune Debian:12

    Versions
    • 2.0.4-1
    • 2.0.4-2
    • 3.0.2-1
    • 3.0.2-2
    • 3.1.3-1
    • 3.1.4-1
    • 3.3.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune Debian:13

    Versions
    • 3.1.3-1
    • 3.1.4-1
    • 3.3.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune Debian:14

    Versions
    • 3.1.3-1
    • 3.1.4-1
    • 3.3.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune PyPI

    Versions
    • 0.1.0
    • 0.2.0
    • 0.3.0
    • 0.3.1
    • 0.4
    • 0.4.1
    • 0.5
    • 0.5.1
    • 0.6
    • 0.7
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.8
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 0.8.4
    • 2.0.0
    • 2.0.0a1
    • 2.0.0a2
    • 2.0.0a3
    • 2.0.0a4
    • 2.0.0a5
    • 2.0.0a6
    • 2.0.0rc1
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.1.0
    • 3.0.0
    • 3.0.0a1
    • 3.0.0a2
    • 3.0.0a3
    • 3.0.0rc1
    • 3.0.0rc2
    • 3.0.0rc3
    • 3.0.0rc4
    • 3.0.0rc5
    • 3.0.1
    • 3.0.2
    • 3.1.0
    • 3.1.1
    • 3.1.2
    • 3.1.3
    • 3.1.4
    • 3.2.0
    • 3.2.1
    Affected ranges
    • ECOSYSTEM: < 3.3.0

    Update to 3.3.0

  • mistune Ubuntu:16.04:LTS

    Versions
    • 0.6-2
    • 0.7.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune Ubuntu:18.04:LTS

    Versions
    • 0.7.4-1
    • 0.8-1
    • 0.8.1-1
    • 0.8.3-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune Ubuntu:20.04:LTS

    Versions
    • 0.8.4-1
    • 0.8.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune Ubuntu:22.04:LTS

    Versions
    • 0.8.4-4
    • 0.8.4-5
    • 2.0.0-1+really0.8.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune Ubuntu:24.04:LTS

    Versions
    • 2.0.4-2
    • 3.0.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune Ubuntu:25.10

    Versions
    • 3.0.2-2
    • 3.1.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune Ubuntu:26.10

    Versions
    • 3.1.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune Ubuntu:26.04:LTS

    Versions
    • 3.1.3-1
    • 3.1.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →