CVE-2026-115348

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parselinktext function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '' or '!' characters, forcing...

CVE-2026-115348 Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parselinktext function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '' or '!' characters, forcing...

EUVD-2026-108417

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parselinktext function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '' or '!' characters, forcing...

CVE-2026-115348

The Mistune Markdown parser versions 3.0.0 through 3.2.x (before 3.3.0) is vulnerable to an algorithmic complexity flaw in the parse_link_text function. Unauthenticated attackers can cause a Denial of Service (DoS) by submitting Markdown containing numerous unbalanced [ or ![ characters. This tri...

CVE-2026-115348 Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parselinktext function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '' or '!' characters, forcing...

CVE-2026-115348 Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parselinktext function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '' or '!' characters, forcing...

CVE-2026-115348

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parselinktext function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '' or '!' characters, forcing...

CVE-2026-115347

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parselinktext that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html, triggering...

CVE-2026-115347 Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parselinktext that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html, triggering...

CVE-2026-115347 Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parselinktext that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html, triggering...

CVE-2026-115347

The Mistune markdown processor, in versions prior to 3.3.0 , is susceptible to an inefficient algorithmic complexity vulnerability within the parse_link_text function. Remote attackers can trigger a denial of service (DoS) by submitting markdown containing long runs of unmatched square brackets t...

EUVD-2026-108416

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parselinktext that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html, triggering...

CVE-2026-115347

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parselinktext that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html, triggering...

CVE-2026-115347 Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parselinktext that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html, triggering...

PT-2026-121528

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse link text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '' or '!' characters, forci...

PT-2026-121527

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse link text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html, triggering...

fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

Rocky Linux 9 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc (crlsa-2025_7109)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257109 advisory. python: cpython: URL parser allowed square brackets in domain names CVE-2025-0938 Tenable has extracted the preceding description block directly from the CIQ securi...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2025_7107)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257107 advisory. python: cpython: URL parser allowed square brackets in domain names CVE-2025-0938 Tenable has extracted the preceding description block directly from the CIQ securi...

Rocky Linux 9 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc (crlsa-2025_6977)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20256977 advisory. python: cpython: URL parser allowed square brackets in domain names CVE-2025-0938 Tenable has extracted the preceding description block directly from the CIQ securi...