CVE-2026-121438

The Mistune markdown library versions before 3.3.3 is vulnerable to a Denial of Service (DoS) condition in the InlineParser.parse_link function. The root cause is quadratic CPU growth triggered when parsing crafted Markdown containing thousands of balanced nested brackets that do not form valid l...

EUVD-2026-115860

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...

CVE-2026-121438: lepture mistune: Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to…

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...