CVE-2026-115352: Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parselinktext and parselinklabel probing, occupying rendering workers for 30+ seconds per 16 KB input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mistuneto a version that resolves this vulnerability.Fixed in 3.4.0-1
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Deployments using Mistune versions before 3.3.0 are affected when they parse attacker-controlled Markdown. The vulnerable code is the inline link parser.
What does an attacker need to exploit it?
An attacker needs only the ability to submit Markdown for parsing; no authentication or user interaction is required. Long runs of unmatched '[' characters trigger repeated parser probing.
What is the operational impact of a successful attack?
The malformed input causes quadratic-time processing in parse_link_text and parse_link_label, exhausting CPU and tying up rendering workers. A 16 KB payload can occupy a worker for more than 30 seconds.
What can be done if upgrading is not immediately possible?
The provided information does not identify a configuration workaround. Limit or reject untrusted Markdown containing long runs of unmatched '[' characters until Mistune can be updated to 3.3.0 or later.