Mistune: Algorithmic complexity denial of service in parse_link_text (CVE-2026-115349)

Mistune versions 3.0.0 before 3.3.0 contain an algorithmic complexity vulnerability in the parse_link_text function within src/mistune/helpers.py. The vulnerability allows a remote attacker to cause a denial-of-service condition by submitting small, specially crafted Markdown strings containing deeply nested square brackets. This input triggers a quadratic complexity in the parsing logic, leading to high CPU usage and service exhaustion.

Impact

Successful exploitation results in service degradation or complete denial of service for applications utilizing the affected version of Mistune to process user-supplied Markdown input, as CPU resources are monopolized by the inefficient regex processing.

Recommendation

• Upgrade the mistune library to version 3.3.0 or later immediately.
• Identify applications within the organization that utilize mistune for processing untrusted user input and prioritize those for patching.
• Implement input length limits or complexity analysis for Markdown content processed by external-facing services to mitigate potential DoS attempts if immediate patching is not possible.