Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3

Mistune, a Python Markdown parser, contains a denial-of-service vulnerability in versions 3.3.0 through 3.3.2. The vulnerability arises from deeply nested emphasis tokens generated by consecutive asterisk characters in crafted Markdown input. The HTMLRenderer.render_token() method processes these tokens recursively, which can exceed Python's default recursion limit and raise a RecursionError. This allows an attacker to crash any process that parses untrusted Markdown using affected versions of Mistune. The issue is classified as a DoS vulnerability with no data exfiltration or code execution implications. A fix has been released in version 3.3.3, which addresses the recursive rendering behavior. Users are advised to upgrade immediately to mitigate the risk.