UBUNTU-CVE-2026-121438: Medium severity ubuntu/mistune vulnerability

Published Nov 3, 2026

Updated

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering repeated containsnestedlink scans that exhaust CPU in parsing applications.

Affected Software

7 affected components

ubuntu/mistune*

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications that parse attacker-controlled or otherwise untrusted Markdown using Mistune are exposed. The affected parser path can consume excessive CPU when processing specially crafted nested brackets.

What does an attacker need to exploit it?

An attacker only needs to submit crafted Markdown containing thousands of balanced nested bracket pairs that do not form a valid link. No authentication or user interaction is required according to the supplied severity vector.

What is the impact of exploitation?

The crafted input causes quadratic CPU growth through repeated nested-link scans, which can exhaust CPU during Markdown parsing and result in denial of service. The provided vector indicates availability impact only, with no confidentiality or integrity impact.

UBUNTU-CVE-2026-121438: Medium severity ubuntu/mistune vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of exploitation?