PT-2026-121527 · Lepture · Mistune
CVE-2026-115347
·
Published
2026-10-22
·
Updated
2026-10-22
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse link text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mistune