CVE-2026-115349

EUVD-2026-108418
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 26.67%
Debian logo
Debian Releases
Debian Product
Codename
mistune
bookworm
vulnerable
forky
vulnerable
sid
3.4.0-1
fixed
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/lepture/mistune/security/advisories/GHSA-3q64-rw38-243v
https://www.vulncheck.com/advisories/mistune-3.0.0-before-3.3.0-denial-of-service-via-nested-bracket-parsing