Algorithmic Complexity Vulnerability in Mistune by Lepture

CVE-2026-115348

What is CVE-2026-115348?

Mistune, a popular Markdown parsing library, contains an algorithmic complexity vulnerability within its inline link parser's parse_link_text function. This flaw enables unauthenticated attackers to craft specific Markdown input with numerous unbalanced brackets, overwhelming CPU resources. As a result, the parser may engage in extensive and unbounded forward scanning, leading to denial of service by monopolizing worker processes for extended periods. It is crucial for users of Mistune to upgrade to version 3.3.0 or later to mitigate this risk.

References