Live › vulnerability › CVE-2026-115348
Go to dashboardMistune, a Python Markdown parser, has an algorithmic complexity flaw in its inline link parser. An unauthenticated attacker can send Markdown with many unbalanced '[' or '![' characters to tie up worker processes for minutes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
pip show mistune (or check the installed version in your lockfile) and see whether it is between 3.0.0 and 3.2.x.
Upgrade mistune to 3.3.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
This page as .md · .json · in your agent: get_signal("CVE-2026-115348")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.