Live › vulnerability › CVE-2026-115349
Go to dashboardMistune's parse_link_text function in helpers.py takes quadratic time on markdown with deeply nested square brackets. A small crafted request can tie up server CPU and cause denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Upgrade mistune to 3.3.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-115349")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.