CVE-2026-115347: Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

Q: Who is exposed to this denial-of-service issue?

Applications using Mistune before 3.3.0 that pass remotely supplied Markdown to mistune.html() are exposed. An attacker can stall worker processes by submitting Markdown with long runs of unmatched square brackets.

Q: Does exploitation require authentication or user interaction?

No. The reported vector is network-accessible, requires no privileges, and does not require user interaction.

Q: What is the practical impact of a successful attack?

The inefficient parsing behavior causes repeated forward scans in parse_link_text. Crafted input can stall worker processes for minutes, resulting in denial of service.

Published Oct 22, 2026

Updated

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parselinktext that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.

Affected Software

1 affected component

pypi/mistune<3.3.0

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Applications using Mistune before 3.3.0 that pass remotely supplied Markdown to mistune.html() are exposed. An attacker can stall worker processes by submitting Markdown with long runs of unmatched square brackets.

Does exploitation require authentication or user interaction?

No. The reported vector is network-accessible, requires no privileges, and does not require user interaction.

What is the practical impact of a successful attack?

The inefficient parsing behavior causes repeated forward scans in parse_link_text. Crafted input can stall worker processes for minutes, resulting in denial of service.

CVE-2026-115347: Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Does exploitation require authentication or user interaction?

What is the practical impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Does exploitation require authentication or user interaction?

What is the practical impact of a successful attack?