CVE-2026-115352

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0

Description An algorithmic complexity issue exists in the inline link parser. Unauthenticated attackers can cause CPU exhaustion by submitting markdown payloads containing long sequences of unmatched '[' characters. This triggers O(N^2) complexity during parse link text() and parse link label() probing, which can occupy rendering workers for over 30 seconds for every 16 KB of input.

Recommendations Update to version 3.3.0 or later.