CVE-2026-121438

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.3

Description A denial of service issue exists in the InlineParser.parse link() function. An attacker can cause quadratic CPU growth by providing crafted Markdown containing thousands of balanced nested brackets that do not form a valid link. This triggers repeated scans by the contains nested link function, leading to CPU exhaustion in applications parsing the input.

Recommendations Update to version 3.3.3 or later.