---
id: "CVE-2026-115347"
kind: "vulnerability"
aliases: ["CVE-2026-115347"]
title: "Mistune: crafted markdown with unbalanced brackets stalls workers for minutes"
severity: "high"
cvss: 8.7
epss: 0.00409
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["markdown-rendering", "mistune", "package", "python", "web-apps"]
not_affected_if: ["no-user-markdown", "trusted-input-only"]
published_at: "2026-10-22T19:17:40+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115347", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115347", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Mistune: crafted markdown with unbalanced brackets stalls workers for minutes

Mistune before 3.3.0 has a parsing flaw in link text handling that scans repeatedly when square brackets are unbalanced. An attacker who submits markdown with long runs of unmatched brackets to mistune.html() can stall worker processes for minutes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run pip show mistune and check whether the installed version is below 3.3.0.

## Fix

Upgrade mistune to 3.3.0 or later.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115347
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115347

## From the sources

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_