CVE-2026-115352: Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser

Q: Which deployments are exposed to this denial-of-service condition?

Deployments using Mistune versions before 3.3.0 are affected when they parse attacker-controlled Markdown. The vulnerable code is the inline link parser.

Q: What does an attacker need to exploit it?

An attacker needs only the ability to submit Markdown for parsing; no authentication or user interaction is required. Long runs of unmatched '[' characters trigger repeated parser probing.

Q: What is the operational impact of a successful attack?

The malformed input causes quadratic-time processing in parse_link_text and parse_link_label, exhausting CPU and tying up rendering workers. A 16 KB payload can occupy a worker for more than 30 seconds.

Q: What can be done if upgrading is not immediately possible?

The provided information does not identify a configuration workaround. Limit or reject untrusted Markdown containing long runs of unmatched '[' characters until Mistune can be updated to 3.3.0 or later.

Published Oct 22, 2026

Updated

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parselinktext and parselinklabel probing, occupying rendering workers for 30+ seconds per 16 KB input.

Affected Software

1 affected component

pypi/mistune<3.3.0

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

Deployments using Mistune versions before 3.3.0 are affected when they parse attacker-controlled Markdown. The vulnerable code is the inline link parser.

What does an attacker need to exploit it?

An attacker needs only the ability to submit Markdown for parsing; no authentication or user interaction is required. Long runs of unmatched '[' characters trigger repeated parser probing.

What is the operational impact of a successful attack?

The malformed input causes quadratic-time processing in parse_link_text and parse_link_label, exhausting CPU and tying up rendering workers. A 16 KB payload can occupy a worker for more than 30 seconds.

What can be done if upgrading is not immediately possible?

The provided information does not identify a configuration workaround. Limit or reject untrusted Markdown containing long runs of unmatched '[' characters until Mistune can be updated to 3.3.0 or later.

CVE-2026-115352: Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

What does an attacker need to exploit it?

What is the operational impact of a successful attack?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

What does an attacker need to exploit it?

What is the operational impact of a successful attack?

What can be done if upgrading is not immediately possible?