Lepture - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/lepture/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 20:27:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMistune: Algorithmic complexity denial of service (CVE-2026-115348)https://feed.craftedsignal.io/briefs/2026-10-mistune-dos-21af0dda/Thu, 22 Oct 2026 20:27:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mistune-dos-21af0dda/Mistune versions 3.0.0 through 3.2.x are vulnerable to an algorithmic complexity issue in the parse_link_text function, allowing unauthenticated attackers to trigger CPU exhaustion via crafted Markdown containing unbalanced brackets.Mistune versions 3.0.0 through 3.2.x contain an algorithmic complexity vulnerability in the parse_link_text function. The vulnerability arises from how the inline link parser handles unbalanced brackets, allowing attackers to supply crafted Markdown input with excessive '[' or '![' characters. This causes the parser to perform repeated unbounded forward scans, which can lead to CPU exhaustion and the denial of service of worker processes.

Impact

Successful exploitation can lead to a denial of service (DoS) by consuming CPU resources, potentially causing application-level performance degradation or service outages by exhausting available worker processes.

Recommendation

Update the Mistune library to version 3.3.0 or later to include the fix for CVE-2026-115348. Applications that accept user-provided Markdown input and process it using affected versions of Mistune should prioritize this patch.

]]>lowadvisorydenial-of-servicevulnerabilitymarkdown-parser