OESA-2026-4792: python-mistune security update

Q: Which deployments are exposed to these denial-of-service issues?

Deployments are exposed if they use affected Mistune versions to process Markdown that can be submitted by remote, unauthenticated users. The affected parsing path is reached through mistune.html() and the inline link parser.

Q: What input is required to trigger the issue?

An attacker needs to submit Markdown with long runs of unmatched square brackets, including '[' or '![' sequences. Deeply nested square brackets can also trigger quadratic parsing behavior, causing worker processes to stall or exhaust CPU for minutes.

Q: Are credentials or user interaction required for exploitation?

No. The reported CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction.

Q: What versions are affected?

Mistune versions before 3.3.0 are affected by CVE-2026-115347. CVE-2026-115348 affects Mistune versions from 3.0.0 before 3.3.0.

Published Nov 11, 2026

Updated

The python-mistune package is a fast yet powerful Python Markdown parser with renderers and plugins, compatible with sane CommonMark rules. Security Fix(es):

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parselinktext that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.(CVE-2026-115347)

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parselinktext function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.(CVE-2026-115348)

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.(CVE-2026-115349)

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parselinktext and parselinklabel probing, occupying rendering workers for 30+ seconds per 16 KB input.(CVE-2026-115352)

Affected Software

1 affected componentFixes available

openeuler/python-mistune<0.8.3-9.oe2203sp4

0.8.3-9.oe2203sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/python-mistune to a version that resolves this vulnerability.
Fixed in 0.8.3-9.oe2203sp4
Upgrade
Upgrade python-mistune to a version that resolves this vulnerability.
Fixed in 3.3.0

Event History

Nov 11, 2026

Advisory Published

via OSV·12:26 PM

Data Sourced

via OSV·12:26 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments are exposed to these denial-of-service issues?

Deployments are exposed if they use affected Mistune versions to process Markdown that can be submitted by remote, unauthenticated users. The affected parsing path is reached through mistune.html() and the inline link parser.

What input is required to trigger the issue?

An attacker needs to submit Markdown with long runs of unmatched square brackets, including '[' or '![' sequences. Deeply nested square brackets can also trigger quadratic parsing behavior, causing worker processes to stall or exhaust CPU for minutes.

Are credentials or user interaction required for exploitation?

No. The reported CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction.

What versions are affected?

Mistune versions before 3.3.0 are affected by CVE-2026-115347. CVE-2026-115348 affects Mistune versions from 3.0.0 before 3.3.0.

OESA-2026-4792: python-mistune security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to these denial-of-service issues?

What input is required to trigger the issue?

Are credentials or user interaction required for exploitation?

What versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to these denial-of-service issues?

What input is required to trigger the issue?

Are credentials or user interaction required for exploitation?

What versions are affected?