CVE-2026-115349: Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mistuneto a version that resolves this vulnerability.Fixed in 3.4.0-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Mistune versions from 3.0.0 before 3.3.0 are exposed if they parse attacker-controlled or otherwise untrusted Markdown. An unauthenticated remote attacker can trigger the issue by submitting a crafted Markdown input.
What input is needed to exploit the vulnerability?
The attacker needs to provide Markdown containing deeply nested square brackets. This causes quadratic processing in parse_link_text and can consume server CPU with a small request.
What is the remediation?
Upgrade Mistune to version 3.3.0 or later. The affected range is 3.0.0 through versions before 3.3.0.