CVE-2026-115347

CVSS 8.7 (high) · published 2026-10-22

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.

Weakness: CWE-407

Source: NVD CVE-2026-115347

References

• https://github.com/lepture/mistune/security/advisories/GHSA-f32h-38gf-rg5r
• https://www.vulncheck.com/advisories/mistune-before-3.3.0-quadratic-denial-of-service-via-parse-link-text

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.