CVE-2026-115347 in Mistune
Summary
by MITRE • 10/22/2026
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Mistune versions prior to 3.3.0 represents a significant algorithmic complexity flaw within the parse_link_text function, which is responsible for processing markdown link syntax. This issue stems from an inefficient parsing strategy that fails to account for unbalanced or malformed input structures efficiently. Specifically, when the parser encounters long sequences of unmatched square brackets, it engages in repeated forward scans across the input string rather than utilizing a more optimized state machine or linear-time algorithmic approach. This behavior results in exponential time complexity relative to the length and structure of the maliciously crafted markdown content, creating a classic ReDoS-like scenario where specific inputs cause disproportionate computational overhead.
From an operational perspective, this vulnerability allows remote attackers to induce denial of service conditions against services that utilize Mistune for rendering user-supplied markdown content. By submitting specially crafted markdown strings containing extensive runs of unbalanced square brackets, an attacker can trigger the inefficient parsing logic within mistune.html(). This action causes worker processes to stall for extended periods, potentially lasting several minutes depending on the length and complexity of the input string. In web application environments where Mistune is employed as part of a request-handling pipeline, such stalls can lead to thread exhaustion, resource starvation, or complete unavailability of the service for legitimate users, effectively rendering the application unusable during the attack window.
The technical root cause lies in how the parser handles bracket matching logic without adequate bounds checking or early exit conditions for malformed sequences. Instead of detecting invalid syntax quickly and raising an error, the algorithm continues to scan forward repeatedly, attempting to resolve non-existent closing brackets. This design flaw violates principles of robust input validation and efficient resource management commonly found in secure coding standards. The vulnerability aligns with CWE-400, which classifies issues related to uncontrolled resource consumption due to inefficient algorithms or data structures that fail to handle edge cases appropriately.
Mitigation strategies primarily involve upgrading the Mistune library to version 3.3.0 or later, where this algorithmic inefficiency has been addressed through optimized parsing logic. For organizations unable to immediately patch their dependencies, implementing input validation layers at the application gateway or web server level can help mitigate risk by filtering out excessively long strings of unbalanced brackets before they reach the markdown parser. Additionally, configuring timeout mechanisms for worker processes ensures that any single request consuming excessive CPU time is terminated gracefully, preventing it from blocking other requests and maintaining overall system availability despite the presence of the vulnerability in the underlying library.