Hi,

The following vulnerability was published for mistune.

CVE-2026-76098[0]:
| Mistune is a Python Markdown parser with renderers and plugins.
| Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply
| nested tokens. HTML rendering creates deeply nested emphasis tokens
| from consecutive asterisk characters, and recursive rendering in
| HTMLRenderer.render_token() can exceed Python's recursion limit and
| raise RecursionError, allowing crafted Markdown to crash a parsing
| process. This issue is fixed in version 3.3.3


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-76098
https://www.cve.org/CVERecord?id=CVE-2026-76098
[1] https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq
[2] https://github.com/lepture/mistune/commit/0938fb781d0aded99de801b340ec1f8debeae5b2

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore