CVE-2026-121438: Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing

Published Nov 3, 2026

Updated

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering repeated containsnestedlink scans that exhaust CPU in parsing applications.

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Applications using Mistune versions earlier than 3.3.3 are exposed when they parse Markdown supplied by an attacker. The issue affects the inline link parsing path.

What does an attacker need to exploit this issue?

An attacker needs to submit crafted Markdown containing thousands of balanced nested bracket pairs that do not form a valid link. The supplied vector indicates no authentication or user interaction is required.

How can I determine whether an application is affected?

Check whether the application uses a Mistune release before 3.3.3 and accepts or processes externally supplied Markdown. Parsing the crafted bracket-heavy input can cause excessive CPU consumption.

What is the available remediation?

Upgrade Mistune to version 3.3.3 or later. The affected versions are those before 3.3.3.

CVE-2026-121438: Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether an application is affected?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether an application is affected?

What is the available remediation?