CVE-2026-115349: Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing

Q: Who is exposed to this issue?

Applications using Mistune versions from 3.0.0 before 3.3.0 are exposed if they parse attacker-controlled or otherwise untrusted Markdown. An unauthenticated remote attacker can trigger the issue by submitting a crafted Markdown input.

Q: What input is needed to exploit the vulnerability?

The attacker needs to provide Markdown containing deeply nested square brackets. This causes quadratic processing in parse_link_text and can consume server CPU with a small request.

Q: What is the remediation?

Upgrade Mistune to version 3.3.0 or later. The affected range is 3.0.0 through versions before 3.3.0.

Published Oct 22, 2026

Updated

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.

Affected Software

1 affected component

pypi/mistune>=3.0.0<3.3.0

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using Mistune versions from 3.0.0 before 3.3.0 are exposed if they parse attacker-controlled or otherwise untrusted Markdown. An unauthenticated remote attacker can trigger the issue by submitting a crafted Markdown input.

What input is needed to exploit the vulnerability?

The attacker needs to provide Markdown containing deeply nested square brackets. This causes quadratic processing in parse_link_text and can consume server CPU with a small request.

What is the remediation?

Upgrade Mistune to version 3.3.0 or later. The affected range is 3.0.0 through versions before 3.3.0.

CVE-2026-115349: Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What input is needed to exploit the vulnerability?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What input is needed to exploit the vulnerability?

What is the remediation?