A vulnerability in the lepture Mistune parser allows unauthenticated remote attackers to trigger a denial of service condition via uncontrolled recursion.

This is an uncontrolled recursion vulnerability (CWE-674) within the Markdown parsing logic. The flaw is exploitable by an unauthenticated attacker who provides malicious input to the parser, leading to excessive resource consumption and application instability.

Successful exploitation of this vulnerability results in a denial of service, rendering the affected application unavailable to legitimate users. Given the CVSS score of 7.5, this high severity issue poses a significant risk to operational continuity, especially for services that rely heavily on user-generated Markdown content.

Immediate Action: Update the Mistune library to version 3.3.3 or later to incorporate the recursive logic fix.

Proactive Monitoring: Monitor server CPU and memory utilization for spikes following the submission of user-provided Markdown content.

Compensating Controls: Implement strict input length and complexity limits on processed Markdown to reduce the feasibility of triggering deep recursion paths.

Public Exploit Available: Unknown.

The vulnerability in Mistune represents a credible threat to system availability. Administrators should prioritize the update to version 3.3.3 immediately to eliminate the recursion path that enables denial of service attacks.