CVE-2026-115347
published 2026-10-22CVE-2026-115347: Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.41%
35.1th percentile
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lepture | mistune | < 3.3.0 | 3.3.0 |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cpu-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cuda-py312-rhel9 | — | — |
| rhoai | odh-th-torch-rocm-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| rhoai | odh-workbench-codeserver-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets.
ghsa_unreviewed·2026-10-22
CVE-2026-115347 [HIGH] CWE-407 Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets.
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Red Hat
mistune: mistune: Denial of Service via unmatched square brackets
vendor_redhat·2026-10-22·CVSS 7.5
CVE-2026-115347 [HIGH] CWE-606 mistune: mistune: Denial of Service via unmatched square brackets
mistune: mistune: Denial of Service via unmatched square brackets
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
A flaw was found in mistune. A remote attacker can exploit an inefficient algorithmic complexity issue in the link text parsing logic by submitting specially crafted Markdown input containing long sequences of unmatched square brackets. Processing this input causes repeated forward scans, leading to excessive resource consumption and a Denial of Service (DoS) that stall
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [epel-9]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115347 [HIGH] CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [epel-9]
CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Bugzilla
CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115347 [HIGH] CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [fedora-rawhide]
CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Bugzilla
CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [fedora-43]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115347 [HIGH] CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [fedora-43]
CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Bugzilla
CVE-2026-115347 python-mistune08: mistune: Denial of Service via unmatched square brackets [epel-9]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115347 [HIGH] CVE-2026-115347 python-mistune08: mistune: Denial of Service via unmatched square brackets [epel-9]
CVE-2026-115347 python-mistune08: mistune: Denial of Service via unmatched square brackets [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Bugzilla
CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [epel-8]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115347 [HIGH] CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [epel-8]
CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Bugzilla
CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [epel-10]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115347 [HIGH] CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [epel-10]
CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Bugzilla
CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [fedora-44]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115347 [HIGH] CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [fedora-44]
CVE-2026-115347 python-mistune: mistune: Denial of Service via unmatched square brackets [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Bugzilla
CVE-2026-115347 mistune: mistune: Denial of Service via unmatched square brackets
bugzilla·2026-10-22·CVSS 7.5
CVE-2026-115347 [HIGH] CVE-2026-115347 mistune: mistune: Denial of Service via unmatched square brackets
CVE-2026-115347 mistune: mistune: Denial of Service via unmatched square brackets
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
2026-10-22
Published