High severity7.5NVD Advisory· Published Oct 22, 2026· Updated Oct 22, 2026

CVE-2026-115347

Description

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Authlib/Mistunellm-create
Range: <3.3.0

Patches

Vulnerability mechanics

References

github.com/lepture/mistune/security/advisories/GHSA-f32h-38gf-rg5rnvd
www.vulncheck.com/advisories/mistune-before-3.3.0-quadratic-denial-of-service-via-parse-link-textnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000