CVE-2026-115349
published 2026-10-22CVE-2026-115349: Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.34%
27.8th percentile
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lepture | mistune | >= 3.0.0 < 3.3.0 | 3.3.0 |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cpu-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cuda-py312-rhel9 | — | — |
| rhoai | odh-th-torch-rocm-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| rhoai | odh-workbench-codeserver-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py.
ghsa_unreviewed·2026-10-22
CVE-2026-115349 [HIGH] CWE-1333 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
Red Hat
mistune: mistune: Denial of Service via deeply nested square brackets
vendor_redhat·2026-10-22·CVSS 7.5
CVE-2026-115349 [HIGH] CWE-606 mistune: mistune: Denial of Service via deeply nested square brackets
mistune: mistune: Denial of Service via deeply nested square brackets
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
A flaw was found in mistune. This flaw allows a remote attacker to cause a Denial of Service (DoS) by submitting crafted Markdown input containing deeply nested square brackets. Processing this input triggers inefficient parsing behavior in the link text parser, exhausting server processor resources and rendering the application unavailable.
Statement: Red Hat Product Security rates this vulnerability as having an
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [epel-10]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115349 [HIGH] CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [epel-10]
CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
Bugzilla
CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [epel-9]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115349 [HIGH] CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [epel-9]
CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
Bugzilla
CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [epel-8]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115349 [HIGH] CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [epel-8]
CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
Bugzilla
CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [fedora-44]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115349 [HIGH] CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [fedora-44]
CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
Bugzilla
CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115349 [HIGH] CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [fedora-rawhide]
CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
Bugzilla
CVE-2026-115349 python-mistune08: mistune: Denial of Service via deeply nested square brackets [epel-9]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115349 [HIGH] CVE-2026-115349 python-mistune08: mistune: Denial of Service via deeply nested square brackets [epel-9]
CVE-2026-115349 python-mistune08: mistune: Denial of Service via deeply nested square brackets [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
Bugzilla
CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [fedora-43]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115349 [HIGH] CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [fedora-43]
CVE-2026-115349 python-mistune: mistune: Denial of Service via deeply nested square brackets [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
Bugzilla
CVE-2026-115349 mistune: mistune: Denial of Service via deeply nested square brackets
bugzilla·2026-10-22·CVSS 7.5
CVE-2026-115349 [HIGH] CVE-2026-115349 mistune: mistune: Denial of Service via deeply nested square brackets
CVE-2026-115349 mistune: mistune: Denial of Service via deeply nested square brackets
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
2026-10-22
Published