125 matches found
RUSTSEC-2026-0433 Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`
With Options::ENABLEWIKILINKS, handlewikilink builds a wikilink's target from the raw text of its body: scanwikilinkpipe walks it looking for |, then contains'\0' and fromreplacenuls walk it again. Once a wikilink is created, disablealllinks only disables Link entries, so every enclosing ! stays...
Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`
With Options::ENABLEWIKILINKS, handlewikilink builds a wikilink's target from the raw text of its body: scanwikilinkpipe walks it looking for |, then contains'\0' and fromreplacenuls walk it again. Once a wikilink is created, disablealllinks only disables Link entries, so every enclosing ! stays...
npm: Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
npm: Nodemailer: Quadratic On^2 SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, = 10.0.9...
UBUNTU-CVE-2026-115349
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...
SUSE CVE-2026-115349
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...
Linux Distros Unpatched Vulnerability : CVE-2026-115349
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py...
DEBIAN-CVE-2026-115349
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...
CVE-2026-115349
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...
CVE-2026-115349
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...
CVE-2026-115349 Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...
CVE-2026-115349 Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...
CVE-2026-115349
The Mistune markdown library, versions 3.0.0 through 3.2.x , is vulnerable to an algorithmic complexity denial of service (DoS) in the parse_link_text function located in src/mistune/helpers.py. An attacker can submit a small, specially crafted markdown request containing deeply nested square bra...
EUVD-2026-108418
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...
CVE-2026-115349
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...
CVE-2026-115349
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...
CVE-2026-115349 Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...
PT-2026-121529
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse link text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafte...
NPM: msgpack5: Quadratic parsing in the streaming decoder
NPM: msgpack5: Quadratic parsing in the streaming decoder vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...
GHSA-GCX5-HXJ7-GPQQ msgpack5: Quadratic parsing in the streaming decoder
Impact The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop. Patches The decoder now preserves incremental...