CVE-2026-115352
published 2026-10-22CVE-2026-115352: Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.44%
38.0th percentile
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lepture | mistune | < 3.3.0 | 3.3.0 |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cpu-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cuda-py312-rhel9 | — | — |
| rhoai | odh-th-torch-rocm-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| rhoai | odh-workbench-codeserver-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters
ghsa_unreviewed·2026-10-22
CVE-2026-115352 [HIGH] CWE-407 Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
Red Hat
mistune: mistune: Denial of Service via unmatched brackets in inline link parser
vendor_redhat·2026-10-22·CVSS 7.5
CVE-2026-115352 [HIGH] CWE-606 mistune: mistune: Denial of Service via unmatched brackets in inline link parser
mistune: mistune: Denial of Service via unmatched brackets in inline link parser
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
A flaw was found in mistune. This algorithmic complexity vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by submitting specially crafted Markdown input containing long sequences of unmatched bracket characters. When parsing this malformed input, the inline link parser consumes excessive CPU resources,
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [epel-9]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115352 [HIGH] CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [epel-9]
CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
Bugzilla
CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [fedora-44]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115352 [HIGH] CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [fedora-44]
CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
Bugzilla
CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [epel-10]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115352 [HIGH] CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [epel-10]
CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
Bugzilla
CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [epel-8]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115352 [HIGH] CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [epel-8]
CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
Bugzilla
CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [fedora-43]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115352 [HIGH] CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [fedora-43]
CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
Bugzilla
CVE-2026-115352 python-mistune08: mistune: Denial of Service via unmatched brackets in inline link parser [epel-9]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115352 [HIGH] CVE-2026-115352 python-mistune08: mistune: Denial of Service via unmatched brackets in inline link parser [epel-9]
CVE-2026-115352 python-mistune08: mistune: Denial of Service via unmatched brackets in inline link parser [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
Bugzilla
CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115352 [HIGH] CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [fedora-rawhide]
CVE-2026-115352 python-mistune: mistune: Denial of Service via unmatched brackets in inline link parser [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
Bugzilla
CVE-2026-115352 mistune: mistune: Denial of Service via unmatched brackets in inline link parser
bugzilla·2026-10-22·CVSS 7.5
CVE-2026-115352 [HIGH] CVE-2026-115352 mistune: mistune: Denial of Service via unmatched brackets in inline link parser
CVE-2026-115352 mistune: mistune: Denial of Service via unmatched brackets in inline link parser
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
2026-10-22
Published