Live › vulnerability › CVE-2026-121438
Mistune, a Python Markdown parser, takes quadratic CPU time on Markdown containing thousands of balanced nested brackets that do not form a link. An attacker who can submit such text to an application that parses it can tie up CPU and cause denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Applications that run Mistune on Markdown supplied by users or other untrusted sources are exposed, since the attack needs only crafted input. Internal tools that parse only trusted Markdown are at much lower risk. unknown for any further detail the sources do not give.
No product ranges from the sources yet.
pip show mistune or by reading the lockfile for mistune3.3.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering repeated _contains_nested_link scans that exhaust CPU in parsing applications.
This page as .md · .json · in your agent: get_signal("CVE-2026-121438")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.