High severity · published Oct 22, 2026
CVE-2026-115352
Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
New
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
mistune · lepture
before 3.3.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115352
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115352
github.com
https://github.com/lepture/mistune/security/advisories/GHSA-xrpv-r66x-8p7j
www.vulncheck.com
https://www.vulncheck.com/advisories/mistune-before-3.3.0-quadratic-time-dos-via-unmatched-brackets-in-inline-parser
More from mistune
8.6
CVE-2026-115353
Mistune before 3.3.0 Path Traversal via include Directive
7.5
CVE-2026-115355
Mistune before 3.3.0 Path Traversal and XSS via Include Directive
7.5
CVE-2026-115349
Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
7.5
CVE-2026-115348
Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text
7.5
CVE-2026-115347
Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text