750 matches found
SUSE CVE-2026-121437
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "ab" to trigger an On^2 index-fixup loop, stalling...
SUSE CVE-2026-121438
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...
CVE-2026-121438
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...
Linux Distros Unpatched Vulnerability : CVE-2026-121438
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying...
Linux Distros Unpatched Vulnerability : CVE-2026-121437
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter...
CVE-2026-121438
A flaw was found in mistune. A remote attacker could cause a Denial of Service DoS by submitting specially crafted Markdown input containing deeply nested brackets. Because the link parser performs repetitive scans when evaluating these nested brackets, processing the crafted input consumes...
CVE-2026-121437
A flaw was found in mistune. A remote attacker could cause a Denial of Service DoS by submitting specially crafted Markdown documents containing repeating emphasis delimiter patterns. Processing these patterns triggers an inefficient index-fixup loop that consumes excessive CPU resources and stal...
CVE-2026-121437
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "ab" to trigger an On² index-fixup loop, stalling...
DEBIAN-CVE-2026-121438
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...
CVE-2026-121438
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...
Inefficient Algorithmic Complexity
Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the parselink method in inlineparser.py, via the parselinktext and containsnestedlink helpers. An attacker can cause quadratic CPU growth by submitting Markdown containing a long run of balanced...
CVE-2026-121437
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "ab" to trigger an On² index-fixup loop, stalling...
CVE-2026-121437 Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "ab" to trigger an On² index-fixup loop, stalling...
CVE-2026-121438 Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...
CVE-2026-121437
Mistune versions 3.3.0 before 3.3.4 are vulnerable to a Denial of Service (DoS) attack due to a quadratic-time complexity issue in the _process_emphasis_delimiters function. Remote attackers can exhaust CPU resources by submitting small Markdown documents containing specific repeated patterns, su...
CVE-2026-121437 Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "ab" to trigger an On² index-fixup loop, stalling...
CVE-2026-121438
The Mistune markdown library versions before 3.3.3 is vulnerable to a Denial of Service (DoS) condition in the InlineParser.parse_link function. The root cause is quadratic CPU growth triggered when parsing crafted Markdown containing thousands of balanced nested brackets that do not form valid l...
EUVD-2026-115859
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "ab" to trigger an On² index-fixup loop, stalling...
CVE-2026-121438 Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...
EUVD-2026-115860
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...