{"items":[{"id":"NVI-00016041","kind":"vulnerability","title":"Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-ffq3-xpv3-j92q","CVE-2026-59928"],"plain_summary":"GitHub lists this reviewed advisory for mistune. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0d339365cc330d8ec94065578729fc1c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T21:24:20.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0d339365cc330d8ec94065578729fc1c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0d339365cc330d8ec94065578729fc1c","url":"https://github.com/advisories/GHSA-ffq3-xpv3-j92q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-ffq3-xpv3-j92q","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:47:44.783Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0d339365cc330d8ec94065578729fc1c"],"technology":"mistune","known_exclusions":[],"conditions_summary":"## Summary\n\n**Type:** Algorithmic-complexity DoS in reference-link definition handling. A markdown document with N reference-link definitions of the same key (or many distinct keys) takes O(N²) parser time. 5000 repeated `[a]: u\\n` definitions take ~1.1 second; 10000 → ~4.5 seconds.\n**File:** `src/mistune/block_parser.py` (reference-link def parsing) and the surrounding `ref_links` env-dictionary handling.\n**Root cause:** every reference definition is parsed by scanning forward from each candidate position. The `unikey` normalisation runs per-def, the dictionary insert is per-def, and the lookup-by-label-then-iterate-defs path is linear in the number of stored defs. For input with N defs, the total work is O(N²).\n\n## Affected Code\n\n`src/mistune/block_parser.py` — reference-definition rule fires on every line that matches `[label]: url`. For each one:\n- `unikey(label)` is called (linear scan of the label).\n- The def is appended to `state.env['ref_links']`.\n- Later inline-link resolution looks up by `unikey(label)` in the dict (O(1)) but the surrounding parser revisits the def list for paragraph-vs-def disambiguation.\n\nThe cumulative parse time grows as the square of the number of de","public_affected_ranges":["< 3.3.0"]}],"null_published_at":"2026-11-04T10:04:27.869Z","source_updated_at":"2026-07-20T21:24:20.000Z","source_disclosed_at":"2026-07-20T21:24:18.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T02:47:44.783Z"}],"next_cursor":null,"snapshot_revision":"42594"}