DEBIAN-CVE-2026-121438: Medium severity debian/mistune vulnerability
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering repeated containsnestedlink scans that exhaust CPU in parsing applications.
Affected Software
Event History
Frequently Asked Questions
What kind of applications are exposed?
Applications that accept and parse attacker-controlled Markdown using Mistune before 3.3.3 are exposed. The vulnerable code path is InlineParser.parse_link, so systems that parse untrusted content are the relevant risk.
What does an attacker need to do to trigger the issue?
An attacker can submit crafted Markdown containing thousands of balanced nested bracket pairs that do not form a valid link. No privileges or user interaction are required.
What is the practical impact?
The crafted input causes repeated _contains_nested_link scans and quadratic CPU growth. This can exhaust CPU resources and deny parsing service availability.
How can I check whether an application is affected?
Check whether the application uses a Mistune version earlier than 3.3.3 and parses untrusted Markdown. Affected behavior can be reproduced by parsing malformed Markdown with deeply nested balanced brackets that do not form a valid link.