Mistune: Algorithmic complexity denial of service (CVE-2026-115348)

Mistune versions 3.0.0 through 3.2.x contain an algorithmic complexity vulnerability in the parse_link_text function. The vulnerability arises from how the inline link parser handles unbalanced brackets, allowing attackers to supply crafted Markdown input with excessive '[' or '![' characters. This causes the parser to perform repeated unbounded forward scans, which can lead to CPU exhaustion and the denial of service of worker processes.

Impact

Successful exploitation can lead to a denial of service (DoS) by consuming CPU resources, potentially causing application-level performance degradation or service outages by exhausting available worker processes.

Recommendation

Update the Mistune library to version 3.3.0 or later to include the fix for CVE-2026-115348. Applications that accept user-provided Markdown input and process it using affected versions of Mistune should prioritize this patch.