Denial of Service in Mistune Library by Lepture
CVE-2026-121438

6.9MEDIUM

Key Information:

Vendor

Lepture

Status
Mistune
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121438?

The Mistune library, prior to version 3.3.3, contains a vulnerability that enables denial of service attacks through its InlineParser.parse_link functionality. Attackers can exploit this flaw by submitting specially crafted Markdown input, which includes excessively nested bracket pairs that do not form valid links. This design flaw prompts the application to engage in repeated scans to check for nested links, resulting in significant CPU resource exhaustion during parsing. Consequently, developers and users relying on Mistune for Markdown processing need to update to the latest version to mitigate potential performance impacts.

Affected Version(s)

mistune 0 < 3.3.3

mistune 3.3.3

References

https://github.com/lepture/mistune/security/advisories/GH...
vendor-advisory
https://github.com/lepture/mistune/commit/fe02f40faf091f8...
patch
https://www.vulncheck.com/advisories/mistune-before-3.3.3...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Str1ckl4nd
.