CVE-2026-115347
Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text
- State
- Published
- Severity
- 8.7 High
- Published
- Oct 22, 2026
- Updated
- Oct 26, 2026
- Reserved
- Oct 22, 2026
Description
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-407 Inefficient Algorithmic Complexity
Affected Products
| Product | Versions |
|---|---|
mistunelepture |
|
References
- GitHub Security Advisory (GHSA-f32h-38gf-rg5r)vendor-advisory
- VulnCheck Advisory: Mistune before 3.3.0 Quadratic Denial of Service via parse_link_textthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.