Algorithmic Complexity Vulnerability in Mistune Markdown Parser by Lepture

CVE-2026-115352

What is CVE-2026-115352?

An algorithmic complexity vulnerability exists in the Mistune markdown parser prior to version 3.3.0. Unauthenticated attackers can exploit this vulnerability by sending relatively small markdown payloads that contain sequences of unmatched '[' characters. This triggers quadratic-time parsing behavior, leading to significant CPU exhaustion. In practical scenarios, the rendering workers can be occupied for extended periods (over 30 seconds for every 16 KB of input) due to the O(N^2) complexity of the parse_link_text and parse_link_label functions. Developers should ensure they are utilizing an updated version of Mistune to mitigate the risk of denial of service attacks.

References