{"id":"CVE-2026-115347","kind":"vulnerability","aliases":["CVE-2026-115347"],"related":[],"title":"Mistune: crafted markdown with unbalanced brackets stalls workers for minutes","description":"Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.","summary":"Mistune before 3.3.0 has a parsing flaw in link text handling that scans repeatedly when square brackets are unbalanced. An attacker who submits markdown with long runs of unmatched brackets to mistune.html() can stall worker processes for minutes.","severity":"high","cvss":8.7,"epss":0.00409,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["markdown-rendering","mistune","package","python","web-apps"],"not_affected_if":["no-user-markdown","trusted-input-only"],"how_to_check":"Run pip show mistune and check whether the installed version is below 3.3.0.","fix":"Upgrade mistune to 3.3.0 or later.","status":"open","published_at":"2026-10-22T19:17:40+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:35:16+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:35:16Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade mistune to 3.3.0 or later.","reach":"internet","title":"Mistune: crafted markdown with unbalanced brackets stalls workers for minutes","impact":"medium","summary":"Mistune before 3.3.0 has a parsing flaw in link text handling that scans repeatedly when square brackets are unbalanced. An attacker who submits markdown with long runs of unmatched brackets to mistune.html() can stall worker processes for minutes.","category":"package","who_cares":["python","mistune","markdown-rendering","web-apps"],"confidence":0.8,"needs_auth":"no","worst_case":"Worker processes stall for minutes; denial of service.","analyst_note":"","how_to_check":"Run pip show mistune and check whether the installed version is below 3.3.0.","needs_analyst":false,"not_affected_if":["trusted-input-only","no-user-markdown"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00082,"input_tokens":2934,"output_tokens":1054,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115347':13A,16A '-2026':12A,15A '3.3.0':28B,66C 'algorithm':70C 'allow':78C 'app':25B 'attack':46B,80C,90C 'bracket':6A,42B,55B,89C,99C 'caus':82C 'complex':71C 'contain':67C,94C 'craft':2A 'cve':11A,14A 'denial':83C 'flaw':32B 'forward':104C 'handl':36B 'ineffici':69C 'link':34B,75C 'long':51B,95C 'markdown':3A,18B,49B,93C 'markdown-rend':17B 'minut':10A,63B,111C 'mistun':1A,20B,26B,64C 'mistune.html':57B,101C 'packag':21B 'pars':31B,74C 'process':61B,109C 'python':22B 'remot':79C 'render':19B 'repeat':39B,103C 'run':52B,96C 'scan':38B,105C 'servic':85C 'squar':41B,88C 'stall':7A,59B,107C 'submit':48B,92C 'text':35B,76C 'trigger':102C 'unbalanc':5A,44B,87C 'unmatch':54B,98C 'vulner':72C 'web':24B 'web-app':23B 'worker':8A,60B,108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115347","severity":null,"published_at":"2026-10-22T19:17:40+00:00","modified_at":"2026-10-22T19:17:40+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115347","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115347","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}