CVE-2026-115348
published 2026-10-22CVE-2026-115348: Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.44%
38.0th percentile
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lepture | mistune | >= 3.0.0 < 3.3.0 | 3.3.0 |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cpu-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cuda-py312-rhel9 | — | — |
| rhoai | odh-th-torch-rocm-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| rhoai | odh-workbench-codeserver-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanc
ghsa_unreviewed·2026-10-22
CVE-2026-115348 [HIGH] CWE-400 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanc
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
Red Hat
mistune: mistune: Denial of Service via unbalanced brackets in link parser
vendor_redhat·2026-10-22·CVSS 7.5
CVE-2026-115348 [HIGH] CWE-606 mistune: mistune: Denial of Service via unbalanced brackets in link parser
mistune: mistune: Denial of Service via unbalanced brackets in link parser
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
A flaw was found in mistune. A remote, unauthenticated attacker can exploit an algorithmic complexity vulnerability in the inline link parser by submitting specially crafted Markdown input containing numerous unbalanced brackets. This forces repeated forward scans during text parsing, consuming excessive CPU resources and resulting in a Denial
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [fedora-43]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115348 [HIGH] CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [fedora-43]
CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
Bugzilla
CVE-2026-115348 python-mistune08: mistune: Denial of Service via unbalanced brackets in link parser [epel-9]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115348 [HIGH] CVE-2026-115348 python-mistune08: mistune: Denial of Service via unbalanced brackets in link parser [epel-9]
CVE-2026-115348 python-mistune08: mistune: Denial of Service via unbalanced brackets in link parser [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
Bugzilla
CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115348 [HIGH] CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [fedora-rawhide]
CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
Bugzilla
CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [epel-8]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115348 [HIGH] CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [epel-8]
CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
Bugzilla
CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [epel-10]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115348 [HIGH] CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [epel-10]
CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
Bugzilla
CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [fedora-44]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115348 [HIGH] CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [fedora-44]
CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
Bugzilla
CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [epel-9]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115348 [HIGH] CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [epel-9]
CVE-2026-115348 python-mistune: mistune: Denial of Service via unbalanced brackets in link parser [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
Bugzilla
CVE-2026-115348 mistune: mistune: Denial of Service via unbalanced brackets in link parser
bugzilla·2026-10-22·CVSS 7.5
CVE-2026-115348 [HIGH] CVE-2026-115348 mistune: mistune: Denial of Service via unbalanced brackets in link parser
CVE-2026-115348 mistune: mistune: Denial of Service via unbalanced brackets in link parser
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
2026-10-22
Published