CVE-2026-115347

HIGH 7.5

Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.

CWE	CWE-407
Vendor	lepture
Product	mistune
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for lepture mistune

Be the first to know when new high vulnerabilities affecting lepture mistune are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

lepture / mistune

0 < 3.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/lepture/mistune/security/advisories/GHSA-f32h-38gf-rg5r vulncheck.com: https://www.vulncheck.com/advisories/mistune-before-3.3.0-quadratic-denial-of-service-via-parse-link-text