Live › vulnerability › CVE-2026-115352
Go to dashboardMistune versions before 3.3.0 have a quadratic-time inline link parser. An unauthenticated attacker can send a short markdown payload of many unmatched '[' characters and tie up rendering workers for 30+ seconds per 16 KB input.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed mistune version, for example with pip show mistune or by reading the lockfile; anything below 3.3.0 is affected.
3.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
This page as .md · .json · in your agent: get_signal("CVE-2026-115352")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.