CVE-2026-115348: Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text

Q: Which deployments are exposed to this denial-of-service issue?

Deployments using Mistune versions from 3.0.0 before 3.3.0 are affected if they process attacker-controlled Markdown. An unauthenticated attacker can reach the vulnerable parser over the network where such Markdown input is accepted.

Q: What input is needed to trigger the issue?

An attacker submits Markdown with many unbalanced '[' or '![' character sequences. This causes repeated unbounded forward scans in parse_link_text, consuming CPU and potentially tying up worker processes for minutes.

Q: Does exploitation require authentication or user interaction?

No. The reported vector is network-accessible, requires low attack complexity, and requires neither privileges nor user interaction.

Q: What is the available remediation?

Upgrade Mistune to version 3.3.0 or later. The affected range is 3.0.0 through versions before 3.3.0.

Published Oct 22, 2026

Updated

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parselinktext function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.

Affected Software

1 affected component

pypi/mistune>=3.0.0<3.3.0

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Deployments using Mistune versions from 3.0.0 before 3.3.0 are affected if they process attacker-controlled Markdown. An unauthenticated attacker can reach the vulnerable parser over the network where such Markdown input is accepted.

What input is needed to trigger the issue?

An attacker submits Markdown with many unbalanced '[' or '![' character sequences. This causes repeated unbounded forward scans in parse_link_text, consuming CPU and potentially tying up worker processes for minutes.

Does exploitation require authentication or user interaction?

No. The reported vector is network-accessible, requires low attack complexity, and requires neither privileges nor user interaction.

What is the available remediation?

Upgrade Mistune to version 3.3.0 or later. The affected range is 3.0.0 through versions before 3.3.0.

CVE-2026-115348: Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What input is needed to trigger the issue?

Does exploitation require authentication or user interaction?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What input is needed to trigger the issue?

Does exploitation require authentication or user interaction?

What is the available remediation?