CVE-2026-49851

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0

Description A CPU exhaustion Denial of Service (DoS) occurs due to superlinear (approximately O(n²)) behavior in the parse link text() function. When processing Markdown containing numerous consecutive [ characters, the function repeatedly scans the input using a regex search within a loop, re-scanning large portions of the remaining string in each iteration. This quadratic-time behavior allows an attacker to trigger excessive CPU usage using a small payload.

Recommendations Update to version 3.3.0.