CVE-2026-115348: Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parselinktext function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mistuneto a version that resolves this vulnerability.Fixed in 3.4.0-1
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using Mistune versions from 3.0.0 before 3.3.0 are affected if they process attacker-controlled Markdown. An unauthenticated attacker can reach the vulnerable parser over the network where such Markdown input is accepted.
What input is needed to trigger the issue?
An attacker submits Markdown with many unbalanced '[' or '![' character sequences. This causes repeated unbounded forward scans in parse_link_text, consuming CPU and potentially tying up worker processes for minutes.
Does exploitation require authentication or user interaction?
No. The reported vector is network-accessible, requires low attack complexity, and requires neither privileges nor user interaction.
What is the available remediation?
Upgrade Mistune to version 3.3.0 or later. The affected range is 3.0.0 through versions before 3.3.0.