CVE-2026-115347
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in…
- Risk score
- 57/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans …
- Affected
- See advisory
- Fix
- Upgrade the product to 3.3.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Last activity 22 Oct 2026. Patch Forecast updates every hour.