GHSA-47p6-w2rc-5qf7: Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering repeated containsnestedlink scans that exhaust CPU in parsing applications.
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this denial of service?
Applications using a Mistune version before 3.3.3 to parse Markdown supplied by attackers or untrusted users are exposed. The vulnerable parsing path is InlineParser.parse_link.
What does an attacker need to exploit the issue?
An attacker only needs network access to submit crafted Markdown; no authentication or user interaction is required. The input uses thousands of balanced nested bracket pairs that do not form a valid link.
What is the impact of a successful attack?
Parsing the crafted Markdown can cause quadratic CPU growth because of repeated _contains_nested_link scans. This can exhaust CPU resources and deny availability of the parsing application.
What version should be used to remediate the issue?
Upgrade Mistune to version 3.3.3 or later. The issue affects versions before 3.3.3.