Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2026-59927 is a medium-severity Uncontrolled Recursion (CWE-674) vulnerability in Mistune Project Mistune. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-24 (Fail in Known State) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-42339
Vulnerability Data
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError,…
more
and crash the rendering request. This issue is fixed in version 3.3.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Requires the system to fail to a known safe state on specified failures, limiting the impact of unhandled exceptional conditions.
Input validation can reject or constrain data that would otherwise drive unbounded recursive calls.
Mandates explicit fail-safe procedures triggered by indicated failures, structurally preventing unhandled or mishandled exceptional conditions.
DoS protection mechanisms limit the resource-exhaustion impact of uncontrolled recursion without eliminating the flaw.
Requires generation of appropriate error messages on exceptional conditions, directly enforcing correct handling rather than silent or incorrect behavior.
System monitoring can observe anomalous resource consumption that signals runaway recursion after it begins.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent coding errors such as missing recursion limits or termination conditions.
Runtime monitoring of compute resources can detect excessive consumption caused by uncontrolled recursion.
Vulnerability identification processes can discover and record uncontrolled recursion flaws before deployment.
Capacity monitoring and resource provisioning can absorb or limit the impact of runaway recursion.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect excessive recursion via static analysis or fuzzing.
Documented operating procedures may specify exception handling but do not guarantee implementation.
Logging captures unhandled exceptions, aiding detection but not preventing the weakness.
Monitoring can surface unhandled exceptions but does not enforce proper handling.
Secure development life cycle requires controls that prevent uncontrolled recursion through design and code review.
Application security requirements can mandate recursion limits or stack-depth checks.