CVE-2026-115352

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '' characters. Attackers can send small markdown payloads that trigger ON^2 parselinktext and parselinklabel...