CVE-2026-115347

high

Description

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.

References

https://www.vulncheck.com/advisories/mistune-before-3.3.0-quadratic-denial-of-service-via-parse-link-text

https://github.com/lepture/mistune/security/advisories/GHSA-f32h-38gf-rg5r

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108416

Details

Source: Mitre, NVD

Published: 2026-10-22

Updated: 2026-10-22

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: High

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: High