PT-2026-121528

CVE-2026-115348

Published

2026-10-22

Updated

2026-11-03

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mistune versions 3.0.0 through 3.2.x

Description An algorithmic complexity issue exists in the inline link parser's parse link text() function. Unauthenticated attackers can cause CPU exhaustion by submitting Markdown containing numerous unbalanced '[' or '![' characters. This triggers repeated unbounded forward scans, which can tie up worker processes for several minutes.

Recommendations Update to version 3.3.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Seankohjs

Vendors

Affected products

Weakness enumeration

CWE-400: Uncontrolled Resource Consumption

Related identifiers