Denial of Service Vulnerability in Mistune by Lepture

CVE-2026-115349

What is CVE-2026-115349?

The Mistune library, used for parsing Markdown, is susceptible to a Denial of Service (DoS) attack due to an algorithmic complexity flaw in its parse_link_text function. When crafted Markdown input with deeply nested square brackets is submitted to the parser, it triggers a quadratic parsing time, which can lead to excessive CPU consumption. This can result in server slowdowns or crashes, making it imperative for users to upgrade to version 3.3.0 or later to mitigate these risks.

References