Mistune (3.0.0 - 3.2.x) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mistune-3.0.0---3.2.x/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 22:30:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMistune: Algorithmic complexity denial of service in parse_link_text (CVE-2026-115349)https://feed.craftedsignal.io/briefs/2026-10-mistune-dos-4e6be477/Thu, 22 Oct 2026 22:30:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mistune-dos-4e6be477/Mistune versions 3.0.0 through 3.2.x are vulnerable to a denial-of-service attack where crafted Markdown inputs with nested square brackets cause excessive CPU consumption during parsing.Mistune versions 3.0.0 before 3.3.0 contain an algorithmic complexity vulnerability in the parse_link_text function within src/mistune/helpers.py. The vulnerability allows a remote attacker to cause a denial-of-service condition by submitting small, specially crafted Markdown strings containing deeply nested square brackets. This input triggers a quadratic complexity in the parsing logic, leading to high CPU usage and service exhaustion.

Impact

Successful exploitation results in service degradation or complete denial of service for applications utilizing the affected version of Mistune to process user-supplied Markdown input, as CPU resources are monopolized by the inefficient regex processing.

Recommendation

  • Upgrade the mistune library to version 3.3.0 or later immediately.
  • Identify applications within the organization that utilize mistune for processing untrusted user input and prioritize those for patching.
  • Implement input length limits or complexity analysis for Markdown content processed by external-facing services to mitigate potential DoS attempts if immediate patching is not possible.
]]>lowadvisoryMistune: Algorithmic complexity denial of service (CVE-2026-115348)https://feed.craftedsignal.io/briefs/2026-10-mistune-dos-21af0dda/Thu, 22 Oct 2026 20:27:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mistune-dos-21af0dda/Mistune versions 3.0.0 through 3.2.x are vulnerable to an algorithmic complexity issue in the parse_link_text function, allowing unauthenticated attackers to trigger CPU exhaustion via crafted Markdown containing unbalanced brackets.Mistune versions 3.0.0 through 3.2.x contain an algorithmic complexity vulnerability in the parse_link_text function. The vulnerability arises from how the inline link parser handles unbalanced brackets, allowing attackers to supply crafted Markdown input with excessive '[' or '![' characters. This causes the parser to perform repeated unbounded forward scans, which can lead to CPU exhaustion and the denial of service of worker processes.

Impact

Successful exploitation can lead to a denial of service (DoS) by consuming CPU resources, potentially causing application-level performance degradation or service outages by exhausting available worker processes.

Recommendation

Update the Mistune library to version 3.3.0 or later to include the fix for CVE-2026-115348. Applications that accept user-provided Markdown input and process it using affected versions of Mistune should prioritize this patch.

]]>lowadvisorydenial-of-servicevulnerabilitymarkdown-parser