CVE-2026-115349
CVE-2026-115349 · Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
CVSS 8.7 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
mistune
- Versions
- ≥ 3.0.0, < 3.3.0: Affected (semver)
- 3.3.0: Not affected (semver)
Update to 3.3.0
mistune Debian:12
- Versions
- 2.0.4-1
- 2.0.4-2
- 3.0.2-1
- 3.0.2-2
- 3.1.3-1
- 3.1.4-1
- 3.3.4-1
- 3.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Debian:13
- Versions
- 3.1.3-1
- 3.1.4-1
- 3.3.4-1
- 3.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Debian:14
- Versions
- 3.1.3-1
- 3.1.4-1
- 3.3.4-1
- 3.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published