CVE-2026-115347: Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parselinktext that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mistuneto a version that resolves this vulnerability.Fixed in 3.4.0-1
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using Mistune before 3.3.0 that pass remotely supplied Markdown to mistune.html() are exposed. An attacker can stall worker processes by submitting Markdown with long runs of unmatched square brackets.
Does exploitation require authentication or user interaction?
No. The reported vector is network-accessible, requires no privileges, and does not require user interaction.
What is the practical impact of a successful attack?
The inefficient parsing behavior causes repeated forward scans in parse_link_text. Crafted input can stall worker processes for minutes, resulting in denial of service.